Cortex - v2022.9

• 1: What's New?
• 2: Overview
• 3: Getting Started
• 3.1: Install On-Premise
• 3.1.1: Install Innovation Only
• 3.1.1.1: Multiple Server - With HA (Recommended)
• 3.1.1.1.1: Architecture
• 3.1.1.1.2: Prerequisites
• 3.1.1.1.3: Install Application Servers and Load Balancer
• 3.1.1.1.4: Install the Web Application Server
• 3.1.1.1.5: Setup Gateway
• 3.1.1.1.6: Try it out
• 3.1.1.2: Single Server - Without HA
• 3.1.1.2.1: Architecture
• 3.1.1.2.2: Prerequisites
• 3.1.1.2.3: Install Application Server
• 3.1.1.2.4: Install the Web Application Server
• 3.1.1.2.5: Setup Gateway
• 3.1.1.2.6: Try it out
• 3.1.1.3: Advanced Setup
• 3.1.1.3.1: Advanced Application Server and Load Balancer Configuration Changes
• 3.1.1.3.2: Configure Firewalls
• 3.1.1.3.3: Configure the Gateway Databases to use Transparent Data Encryption
• 3.1.1.3.4: Create Self-Signed Certificates
• 3.1.1.3.5: Encrypt Text
• 3.1.1.3.6: Port Requirements for Application Servers and Load Balancer
• 3.1.1.3.7: Rollover CA certificates
• 3.1.1.3.8: SSL Best Practices
• 3.1.2: Add Innovation to a 7.2 Installation
• 3.1.2.1: Multiple Server - With HA (Recommended)
• 3.1.2.1.1: Architecture
• 3.1.2.1.2: Prerequisites
• 3.1.2.1.3: Install Application Servers and Load Balancer
• 3.1.2.1.4: Upgrade v7.2 Gateway to Include Innovation
• 3.1.2.1.5: Try it out
• 3.1.2.2: Single Server - Without HA
• 3.1.2.2.1: Architecture
• 3.1.2.2.2: Prerequisites
• 3.1.2.2.3: Install Application Server
• 3.1.2.2.4: Upgrade v7.2 Gateway to Include Innovation
• 3.1.2.2.5: Try it out
• 3.1.3: Add Observability to Innovation
• 3.1.3.1: Grafana
• 3.1.3.1.1: Architecture
• 3.1.3.1.2: Prerequisites
• 3.1.3.1.3: Install Grafana
• 3.1.3.1.3.1: Install Grafana
• 3.1.3.1.3.2: Configure Grafana
• 3.1.3.1.4: Install Grafana Loki
• 3.1.3.1.4.1: Install Loki
• 3.1.3.1.4.2: Configure Loki
• 3.1.3.1.5: Install Promtail
• 3.1.3.1.5.1: Install Promtail
• 3.1.3.1.5.2: Configure Promtail
• 3.1.3.1.6: Setup Grafana
• 3.1.3.1.7: Try it Out
• 3.1.3.1.8: Advanced Setup
• 3.1.3.1.8.1: Create Self-Signed Certificates
• 3.1.3.1.8.2: Port Requirements for the Web Application Server
• 3.1.3.1.8.3: SSL Best Practices
• 3.2: Set up in the Cloud
• 3.2.1: Add Observability to Innovation
• 3.2.1.1: Grafana Cloud
• 3.2.1.1.1: Architecture
• 3.2.1.1.2: Prerequisites
• 3.2.1.1.3: Set up Grafana
• 3.2.1.1.4: Set up Grafana Loki
• 3.2.1.1.5: Install Promtail
• 3.2.1.1.5.1: Install Promtail
• 3.2.1.1.5.2: Configure Promtail
• 3.2.1.1.6: Import Dashboards
• 3.2.1.1.7: Try it Out
• 4: Guides
• 4.1: Cortex API Gateway Service
• 4.2: Cortex Flow Debugger Service
• 4.3: Cortex Flow Execution Service
• 4.4: Cortex Gateway
• 4.4.1: Cortex Gateway Management
• 4.4.1.1: LDAP Authorisation
• 4.4.1.2: LDAP Connection
• 4.4.1.3: License Consumption
• 4.4.1.4: Packages
• 4.4.1.5: Studio Authorisation
• 4.4.1.6: Studio Export
• 4.4.1.7: Studio Hierarchy
• 4.4.1.8: Studio Import
• 4.4.1.9: Version Control
• 4.4.2: Help
• 4.4.2.1: Release Notes
• 4.5: Cortex Studio
• 4.5.1: Cortex Studio - East Panel (TBC)
• 4.5.2: Cortex Studio - Main Display Area
• 4.5.3: Cortex Studio - Navigation
• 4.5.4: Cortex Studio - Package Management (TBC)
• 4.5.5: Cortex Studio - Palettes
• 4.5.6: Cortex Studio - South Panel (TBC)
• 4.5.7: Debugging
• 4.5.8: Cortex Studio - Expression Editor
• 4.5.9: Cortex Studio - Literal Editor
• 4.5.10: Cortex Studio - Variable Editor
• 5: Tutorials
• 5.1: Installation
• 5.2: Setup
• 5.3: Development
• 5.4: Administration
• 6: Reference
• 6.1: Concepts
• 6.1.1: Fundamentals
• 6.1.1.1: Flows
• 6.1.1.1.1: What is a Flow?
• 6.1.1.1.2: Calling Other Flows
• 6.1.1.1.3: Handling Exceptions within a Flow
• 6.1.1.2: Workspaces
• 6.1.1.2.1: What is a Workspace?
• 6.1.1.2.2: Handling Exceptions within a Workspace
• 6.1.1.3: Blocks
• 6.1.1.3.1: What is a Block?
• 6.1.1.3.2: Block Properties
• 6.1.1.3.2.1: What is a Block Property?
• 6.1.1.3.2.2: Property Editors
• 6.1.1.3.2.2.1: Literal Editor
• 6.1.1.3.2.2.2: Variable Editor
• 6.1.1.3.2.2.3: Expression Editor
• 6.1.1.3.2.3: Common Properties
• 6.1.1.3.2.4: Advanced Properties
• 6.1.1.3.3: Handling Exceptions within a Block
• 6.1.1.4: Variables
• 6.1.1.4.1: What is a Variable?
• 6.1.1.4.2: Using Variables
• 6.1.1.4.3: Variable Scopes
• 6.1.1.5: Data Types
• 6.1.1.5.1: What is a Data Type?
• 6.1.1.5.2: Generics
• 6.1.1.5.3: Null and Nullable Types
• 6.1.1.6: Executions
• 6.1.1.6.1: What is an Execution?
• 6.1.1.6.2: Executions in Development
• 6.1.1.6.3: Executions in Production
• 6.1.1.7: Exceptions
• 6.1.1.7.1: What is an Exception?
• 6.1.1.7.2: Handling Exceptions
• 6.1.1.7.3: Throwing Exceptions
• 6.1.1.8: Messages
• 6.1.1.8.1: What is a Message?
• 6.1.2: Working With...
• 6.1.2.1: Collections
• 6.1.2.1.1: What is a Collection?
• 6.1.2.1.2: Items
• 6.1.2.1.3: Indexes
• 6.1.2.1.4: Keys
• 6.1.2.1.5: Occurrences
• 6.1.2.2: Culture
• 6.1.2.2.1: What is a Culture?
• 6.1.2.2.2: Invariant Culture
• 6.1.2.2.3: Current Culture
• 6.1.2.2.4: Specific Cultures
• 6.1.2.2.5: Custom Cultures
• 6.1.2.3: Data Sources
• 6.1.2.3.1: What is a Data Source?
• 6.1.2.3.2: Supported Data Sources
• 6.1.2.3.2.1: ODBC
• 6.1.2.3.2.2: SQL Server
• 6.1.2.4: Date and Time
• 6.1.2.4.1: What is Date and Time?
• 6.1.2.4.2: Date and Time Formatting
• 6.1.2.5: Email
• 6.1.2.5.1: What is Email?
• 6.1.2.6: Enums
• 6.1.2.6.1: What is an Enum?
• 6.1.2.7: Files and Folders
• 6.1.2.7.1: What are Files and Folders?
• 6.1.2.7.2: Attributes
• 6.1.2.7.3: Paths
• 6.1.2.8: Loops
• 6.1.2.8.1: What is a Loop?
• 6.1.2.9: Numbers
• 6.1.2.9.1: What is a Number?
• 6.1.2.10: Objects
• 6.1.2.10.1: What is an Object?
• 6.1.2.10.2: Object Casting
• 6.1.2.10.3: Object Equality
• 6.1.2.11: Text
• 6.1.2.11.1: What is Text?
• 6.1.2.11.2: Casing
• 6.1.2.11.3: Converting Objects To Text
• 6.1.2.11.4: Empty Text and Whitespace
• 6.1.2.11.5: Encoding
• 6.1.2.11.6: Equality
• 6.1.2.11.7: Formatting
• 6.1.2.11.8: Pattern Matching Syntax
• 6.1.2.11.9: Regex Syntax
• 6.2: APIs
• 6.2.1: Cortex API Gateway Service
• 6.2.2: Cortex Flow Debugger Service
• 6.2.3: Cortex Flow Execution Service
• 6.2.4: Cortex Gateway
• 6.2.5: Cortex Studio
• 6.3: Blocks
• 6.3.1: Data
• 6.3.1.1: Execute Data Command
• 6.3.1.1.1: Execute Data Command
• 6.3.2: Date & Time
• 6.3.2.1: Add Time Period
• 6.3.2.1.1: Add Time Period
• 6.3.2.2: Convert Date Time
• 6.3.2.2.1: Convert Date Time To Text
• 6.3.2.2.2: Convert Text To Date Time
• 6.3.2.3: Get Date Time
• 6.3.2.3.1: Get Current Date Time
• 6.3.2.3.2: Get Date Time Component
• 6.3.2.4: Get Time Period
• 6.3.2.4.1: Get Time Period Between Date Times
• 6.3.2.5: Is Date Time
• 6.3.2.5.1: Is Date Time After
• 6.3.2.5.2: Is Date Time Before
• 6.3.2.5.3: Is Date Time Between
• 6.3.2.5.4: Is Date Time Equal
• 6.3.2.6: Subtract Time Period
• 6.3.2.6.1: Subtract Time Period
• 6.3.3: Decisions
• 6.3.3.1: If Else
• 6.3.3.1.1: If Null Exit Bottom
• 6.3.3.1.2: If Null Exit Right
• 6.3.3.1.3: If True Exit Bottom
• 6.3.3.1.4: If True Exit Right
• 6.3.4: Dictionaries
• 6.3.4.1: Add Item(s)
• 6.3.4.1.1: Add Item With Key
• 6.3.4.2: Contains Item(s)
• 6.3.4.2.1: Contains Item With Key
• 6.3.4.2.2: Contains Item With Key And Value
• 6.3.4.2.3: Contains Item With Value
• 6.3.4.2.4: Contains Items With Keys
• 6.3.4.2.5: Contains Items With Values
• 6.3.4.3: Get Count(s) of Items
• 6.3.4.3.1: Get Count Of All Items
• 6.3.4.3.2: Get Count Of Items With Value
• 6.3.4.3.3: Get Counts Of Items With Values
• 6.3.4.4: Get Item(s)
• 6.3.4.4.1: Get All Items
• 6.3.4.4.2: Get Item With Key
• 6.3.4.4.3: Get Items With Key
• 6.3.4.5: Get Key(s)
• 6.3.4.5.1: Get All Keys
• 6.3.4.6: Remove Item(s)
• 6.3.4.6.1: Remove All Items
• 6.3.4.6.2: Remove Item With Key
• 6.3.4.6.3: Remove Item With Value
• 6.3.4.6.4: Remove Items With Key
• 6.3.4.6.5: Remove Items With Keys
• 6.3.4.6.6: Remove Items With Value
• 6.3.4.6.7: Remove Items With Values
• 6.3.4.7: Set Item(s)
• 6.3.4.7.1: Set All Items
• 6.3.4.7.2: Set Item With Key
• 6.3.4.7.3: Set Item With Value
• 6.3.4.7.4: Set Items With Key
• 6.3.4.7.5: Set Items With Keys
• 6.3.4.7.6: Set Items With Value
• 6.3.4.7.7: Set Items With Values
• 6.3.5: Email
• 6.3.5.1: Send Email
• 6.3.5.1.1: Send Email Using SMTP Server
• 6.3.6: Exceptions
• 6.3.6.1: Handle Block Exception(s)
• 6.3.6.1.1: Handle Block Exception
• 6.3.6.1.2: Handle Block Exception Matching Message
• 6.3.6.1.3: Handle Block Exception Matching Messages
• 6.3.6.1.4: Handle Block Exception Matching Type Name
• 6.3.6.1.5: Handle Block Exception Matching Type Names
• 6.3.6.2: Handle Flow Exception(s)
• 6.3.6.2.1: Handle Flow Exception
• 6.3.6.3: Handle Workspace Exception(s)
• 6.3.6.3.1: Handle Workspace Exception
• 6.3.6.4: Rethrow Exception
• 6.3.6.4.1: Rethrow Exception
• 6.3.6.5: Throw Exception
• 6.3.6.5.1: Throw New Flow Exception
• 6.3.7: Files & Folders
• 6.3.7.1: Check File Exists
• 6.3.7.1.1: Check File Exists
• 6.3.7.2: Check Folder Exists
• 6.3.7.2.1: Check Folder Exists
• 6.3.7.3: Copy File(s)
• 6.3.7.3.1: Copy File
• 6.3.7.3.2: Copy Files
• 6.3.7.4: Copy Folder(s)
• 6.3.7.4.1: Copy Folder
• 6.3.7.4.2: Copy Folders
• 6.3.7.4.3: Duplicate Folder
• 6.3.7.5: Create Folder(s)
• 6.3.7.5.1: Create Folder
• 6.3.7.5.2: Create Folders
• 6.3.7.6: Delete File(s)
• 6.3.7.6.1: Delete File
• 6.3.7.6.2: Delete Files
• 6.3.7.7: Delete Folder(s)
• 6.3.7.7.1: Delete Folder
• 6.3.7.7.2: Delete Folders
• 6.3.7.8: Get File Information
• 6.3.7.8.1: Get File Information
• 6.3.7.9: Get Folder Content
• 6.3.7.9.1: Get Folder Content
• 6.3.7.10: Get Folder Information
• 6.3.7.10.1: Get Folder Information
• 6.3.7.11: Move File(s)
• 6.3.7.11.1: Move File
• 6.3.7.11.2: Move Files
• 6.3.7.12: Move Folder(s)
• 6.3.7.12.1: Move Folder
• 6.3.7.12.2: Move Folders
• 6.3.7.13: Read File
• 6.3.7.13.1: Read All Lines
• 6.3.7.13.2: Read All Text
• 6.3.7.14: Rename Folder
• 6.3.7.14.1: Rename Folder
• 6.3.7.15: Search File(s)
• 6.3.7.15.1: Search File
• 6.3.7.15.2: Search Files
• 6.3.7.16: Write File
• 6.3.7.16.1: Write All Lines
• 6.3.7.16.2: Write All Text
• 6.3.8: Flows
• 6.3.8.1: End Flow
• 6.3.8.1.1: End Flow
• 6.3.8.2: Run Flow
• 6.3.8.2.1: Run Flow
• 6.3.8.3: Start Flow
• 6.3.8.3.1: Start Flow
• 6.3.9: Google Workspace
• 6.3.9.1: Gmail
• 6.3.9.1.1: Send Email
• 6.3.9.1.1.1: Send Email Using Gmail
• 6.3.10: Http
• 6.3.10.1: Execute Http Request
• 6.3.10.1.1: Execute Http Request
• 6.3.10.2: Execute Soap Request
• 6.3.10.2.1: Execute Soap Request
• 6.3.11: Json
• 6.3.11.1: Convert Json
• 6.3.11.1.1: Convert Json To Object
• 6.3.11.1.2: Convert Object To Json
• 6.3.12: Lists
• 6.3.12.1: Add Item(s)
• 6.3.12.1.1: Add Item At Beginning
• 6.3.12.1.2: Add Item At End
• 6.3.12.1.3: Add Item At Index
• 6.3.12.1.4: Add Items At Beginning
• 6.3.12.1.5: Add Items At End
• 6.3.12.1.6: Add Items At Index
• 6.3.12.2: Contains Item(s)
• 6.3.12.2.1: Contains Item With Value
• 6.3.12.2.2: Contains Items With Values
• 6.3.12.3: Get Count(s) of Items
• 6.3.12.3.1: Get Count Of All Items
• 6.3.12.3.2: Get Count Of Items With Value
• 6.3.12.3.3: Get Counts Of Items With Values
• 6.3.12.4: Get Index(es) of Items
• 6.3.12.4.1: Get Index Of Item With Value
• 6.3.12.4.2: Get Indexes Of Items With Value
• 6.3.12.5: Get Item(s)
• 6.3.12.5.1: Get Item At Beginning
• 6.3.12.5.2: Get Item At End
• 6.3.12.5.3: Get Item At Index
• 6.3.12.5.4: Get Items At Beginning
• 6.3.12.5.5: Get Items At End
• 6.3.12.5.6: Get Items At Index
• 6.3.12.5.7: Get Items At Indexes
• 6.3.12.6: Remove Item(s)
• 6.3.12.6.1: Remove All Items
• 6.3.12.6.2: Remove Duplicate Items
• 6.3.12.6.3: Remove Item At Beginning
• 6.3.12.6.4: Remove Item At End
• 6.3.12.6.5: Remove Item At Index
• 6.3.12.6.6: Remove Item With Value
• 6.3.12.6.7: Remove Items At Beginning
• 6.3.12.6.8: Remove Items At End
• 6.3.12.6.9: Remove Items At Index
• 6.3.12.6.10: Remove Items At Indexes
• 6.3.12.6.11: Remove Items With Value
• 6.3.12.6.12: Remove Items With Values
• 6.3.12.7: Set Item(s)
• 6.3.12.7.1: Set All Items
• 6.3.12.7.2: Set Item At Beginning
• 6.3.12.7.3: Set Item At End
• 6.3.12.7.4: Set Item At Index
• 6.3.12.7.5: Set Item With Value
• 6.3.12.7.6: Set Items At Beginning
• 6.3.12.7.7: Set Items At End
• 6.3.12.7.8: Set Items At Index
• 6.3.12.7.9: Set Items At Indexes
• 6.3.12.7.10: Set Items With Value
• 6.3.12.7.11: Set Items With Values
• 6.3.13: Logs
• 6.3.13.1: Log Event
• 6.3.13.1.1: Log Event
• 6.3.14: Loops
• 6.3.14.1: For Each Loop
• 6.3.14.1.1: For Each Loop
• 6.3.14.2: For Loop
• 6.3.14.2.1: For Loop
• 6.3.15: Microsoft365
• 6.3.15.1: Outlook
• 6.3.15.1.1: Send Email
• 6.3.15.1.1.1: Send Email Using Microsoft365
• 6.3.16: Objects
• 6.3.16.1: Convert Object
• 6.3.16.1.1: Convert Object To Text
• 6.3.16.2: Copy Object
• 6.3.16.2.1: Copy Object
• 6.3.17: PowerShell
• 6.3.17.1: Execute PowerShell Script
• 6.3.17.1.1: Execute PowerShell Script
• 6.3.18: Schedules
• 6.3.18.1: Wait For
• 6.3.18.1.1: Wait For Duration
• 6.3.19: Ssh
• 6.3.19.1: Execute Ssh Command
• 6.3.19.1.1: Execute Ssh Command
• 6.3.20: Text
• 6.3.20.1: Add Text
• 6.3.20.1.1: Add Text After Index
• 6.3.20.1.2: Add Text At Beginning
• 6.3.20.1.3: Add Text At End
• 6.3.20.1.4: Add Text Before Index
• 6.3.20.2: Contains Text
• 6.3.20.2.1: Contains All Text
• 6.3.20.2.2: Contains Any Text
• 6.3.20.2.3: Contains Text
• 6.3.20.3: Convert To
• 6.3.20.3.1: Convert To Camel Case
• 6.3.20.3.2: Convert To Lower Case
• 6.3.20.3.3: Convert To Pascal Case
• 6.3.20.3.4: Convert To Title Case
• 6.3.20.3.5: Convert To Upper Case
• 6.3.20.4: Find And Remove Text
• 6.3.20.4.1: Find And Remove All Text
• 6.3.20.4.2: Find And Remove Text
• 6.3.20.5: Find And Replace Text
• 6.3.20.5.1: Find And Replace All Text
• 6.3.20.5.2: Find And Replace Text
• 6.3.20.6: Format Text
• 6.3.20.6.1: Format Text With Value
• 6.3.20.6.2: Format Text With Values
• 6.3.20.7: Get Index(es) of Text
• 6.3.20.7.1: Get Index Of Text
• 6.3.20.7.2: Get Indexes Of Text
• 6.3.20.8: Get Length
• 6.3.20.8.1: Get Length
• 6.3.20.9: Get Text
• 6.3.20.9.1: Get Text At Beginning
• 6.3.20.9.2: Get Text At End
• 6.3.20.9.3: Get Text At Index
• 6.3.20.9.4: Get Text Before Index
• 6.3.20.9.5: Get Text Between Indexes
• 6.3.20.10: Is Text
• 6.3.20.10.1: Is Text Empty
• 6.3.20.10.2: Is Text Empty Or Whitespace
• 6.3.20.10.3: Is Text Equal
• 6.3.20.10.4: Is Text Null
• 6.3.20.10.5: Is Text Null Or Empty
• 6.3.20.10.6: Is Text Null, Empty Or Whitespace
• 6.3.20.11: Join Text
• 6.3.20.11.1: Join Text
• 6.3.20.12: Remove Text
• 6.3.20.12.1: Remove Text At Beginning
• 6.3.20.12.2: Remove Text At End
• 6.3.20.12.3: Remove Text At Index
• 6.3.20.12.4: Remove Text Before Index
• 6.3.20.12.5: Remove Text Between Indexes
• 6.3.20.13: Split Text
• 6.3.20.13.1: Split Text
• 6.3.21: Variables
• 6.3.21.1: Set Variable
• 6.3.21.1.1: Set Variable
• 6.3.22: Workspaces
• 6.3.22.1: End Workspace
• 6.3.22.1.1: End Workspace
• 6.3.22.2: Start Workspace
• 6.3.22.2.1: Start Workspace
• 6.3.22.3: Workspace
• 6.3.22.3.1: Workspace
• 6.3.23: Xml
• 6.3.23.1: Convert Xml
• 6.3.23.1.1: Convert Structure To Xml
• 6.3.23.1.2: Convert Xml To Structure
• 6.4: Data Types
• 6.4.1: All
• 6.4.1.1: dynamic
• 6.4.1.2: Object
• 6.4.2: Collections
• 6.4.2.1: Array
• 6.4.2.2: Dictionary<TKey, TItem>
• 6.4.2.3: IDictionary<TKey, TItem>
• 6.4.2.4: IEnumerable
• 6.4.2.5: IEnumerable<TItem>
• 6.4.2.6: IList<TItem>
• 6.4.2.7: List<TItem>
• 6.4.2.8: Structure
• 6.4.3: Conditional Logic
• 6.4.3.1: Boolean
• 6.4.4: Credentials
• 6.4.4.1: UserCredentials
• 6.4.5: Data
• 6.4.5.1: Command
• 6.4.5.2: Commands
• 6.4.5.3: ConnectionDetails
• 6.4.5.4: DataCommand
• 6.4.5.5: NonQueryCommand
• 6.4.5.6: OdbcConnectionDetails
• 6.4.5.7: QueryCommand
• 6.4.5.8: SqlServerConnectionDetails
• 6.4.6: Date & Time
• 6.4.6.1: DateTime
• 6.4.6.2: DateTimeComponentType
• 6.4.6.3: DateTimeOffset
• 6.4.6.4: DayOfWeek
• 6.4.6.5: TimePeriod
• 6.4.6.6: TimeSpan
• 6.4.7: Email
• 6.4.7.1: Authentication
• 6.4.7.1.1: EmailCredentials
• 6.4.7.1.2: EmailUserCredentials
• 6.4.7.1.3: IEmailCredentials
• 6.4.7.2: BasicEmailSessionDetails
• 6.4.7.3: EmailAddress
• 6.4.7.4: EmailMessage
• 6.4.7.5: EmailMessageBodyFormat
• 6.4.7.6: EmailMessagePriority
• 6.4.7.7: EmailSessionErrorCode
• 6.4.8: Exceptions
• 6.4.8.1: Exception
• 6.4.9: Files & Folders
• 6.4.9.1: ContentOptions
• 6.4.9.2: FileInformation
• 6.4.9.3: FileMatch
• 6.4.9.4: FolderInformation
• 6.4.10: Flows
• 6.4.10.1: FlowReference
• 6.4.10.2: InputVariables
• 6.4.11: Google Workspace
• 6.4.11.1: Gmail
• 6.4.11.1.1: Authentication
• 6.4.11.1.1.1: OAuth
• 6.4.11.1.1.1.1: GmailOAuthCertificateCredentials
• 6.4.11.1.2: GmailSessionDetails
• 6.4.12: Http
• 6.4.12.1: Authentication
• 6.4.12.1.1: HttpCredentials
• 6.4.12.1.2: HttpUserCredentials
• 6.4.12.1.3: IHttpCredentials
• 6.4.13: Json
• 6.4.13.1: JsonSerializerSettings
• 6.4.14: Logs
• 6.4.14.1: EventSeverity
• 6.4.15: Loops
• 6.4.15.1: InfiniteLoopErrorCode
• 6.4.16: Numbers
• 6.4.16.1: Double
• 6.4.16.2: Int16
• 6.4.16.3: Int32
• 6.4.16.4: Int64
• 6.4.16.5: Single
• 6.4.17: Session Details
• 6.4.17.1: ServerDetails
• 6.4.18: Ssh
• 6.4.18.1: Authentication
• 6.4.18.1.1: ISshCredentials
• 6.4.18.1.2: SshCredentials
• 6.4.18.1.3: SshUserCredentials
• 6.4.19: Text
• 6.4.19.1: Char
• 6.4.19.2: CultureInfo
• 6.4.19.3: Encoding
• 6.4.19.4: EncryptableText
• 6.4.19.5: EncryptedText
• 6.4.19.6: IFormatProvider
• 6.4.19.7: SearchOptions
• 6.4.19.8: String
• 6.4.19.9: StringComparison
• 6.4.19.10: StringSplitOptions
• 6.4.19.11: UnicodeEncoding
• 6.4.19.12: UTF32Encoding
• 6.4.19.13: UTF8Encoding
• 6.4.20: Other
• 6.4.20.1: Guid
• 6.4.20.2: Nullable<T>
• 6.4.21: Most Common
• 6.5: Exceptions
• 6.5.1: Common
• 6.5.1.1: Property
• 6.5.1.1.1: PropertyContainsNullOrEmptyItemException
• 6.5.1.1.2: PropertyEmptyException
• 6.5.1.1.3: PropertyItemCountException
• 6.5.1.1.4: PropertyNullException
• 6.5.1.1.5: PropertyValueOutOfRangeException
• 6.5.1.2: UnencryptedTextException
• 6.5.2: Data
• 6.5.2.1: CommandException
• 6.5.2.2: InvalidConnectionStringException
• 6.5.3: Decisions
• 6.5.3.1: PropertyNotNullableException
• 6.5.4: Dictionaries
• 6.5.4.1: CannotModifyReadOnlyDictionaryException
• 6.5.4.2: KeyNotPresentException
• 6.5.4.3: KeyPresentException
• 6.5.4.4: KeysNotPresentException
• 6.5.4.5: OccurrenceNotPresentException
• 6.5.5: Email
• 6.5.5.1: EmailSessionException
• 6.5.6: Files & Folders
• 6.5.6.1: InvalidFolderNameException
• 6.5.6.2: InvalidPathException
• 6.5.6.3: OperationFailedException
• 6.5.7: FlowException
• 6.5.8: Flows
• 6.5.8.1: Blocks
• 6.5.8.1.1: BlockTimeoutException
• 6.5.8.1.2: InvalidBlockTimeoutException
• 6.5.8.1.3: InvalidPropertyValueException
• 6.5.8.2: Execution
• 6.5.8.2.1: InvalidInputVariablesException
• 6.5.9: List
• 6.5.9.1: CannotModifyReadOnlyListException
• 6.5.9.2: DuplicateValueException
• 6.5.10: Loops
• 6.5.10.1: InfiniteLoopException
• 6.5.11: Text
• 6.5.11.1: Regex
• 6.5.11.1.1: RegexParsingFailedException
• 6.5.12: Xml
• 6.5.12.1: XmlSerializationException
• 6.6: Logs
• 6.6.1: Cortex Gateway
• 6.6.2: Cortex Studio
• 6.6.3: Cortex Flow Debugger Service
• 6.6.4: Cortex API Gateway Service
• 6.6.5: Cortex Flow Execution Service
• 6.7: Messages
• 6.7.1: Validation
• 6.7.1.1: Errors
• 6.8: Observability
• 6.8.1: Grafana
• 6.8.1.1: Dashboards
• 6.8.1.1.1: Flow Execution Requests
• 6.8.1.1.2: Platform Health
• 6.8.1.2: Advanced Setup
• 6.8.1.2.1: Configuring Thresholds
• 6.9: Troubleshooting
• 6.9.1: Installation
• 6.10: Glossary
• 6.10.1: A-E
• 6.10.2: F-J
• 6.10.3: K-O
• 6.10.4: P-T
• 6.10.5: U-Z
• 6.10.6: 0-9
• 7: FAQs

1 - What's New?

Summary

2022.9 is the first release of the next generation of Cortex and begins our journey to improve on the previous 7.X generation starting with the following areas:

• Performance
• Availability
• Usability
• Security
• Observability

Improved Performance

This release introduces a new engine to execute automation solutions, and has shown significant performance improvements compared to 7.X, both in our own observations and customers installations. For example, one customer solution that has been migrated to 2022.9 has shown the time taken to run their tests reduce from 210 minutes to 10 minutes.

Improved Availability

This release introduces a new high availability (HA) architecture, which provides:

• Elimination of single points of failure resulting in reduced downtime
• The ability to perform zero downtime upgrades
• Increased processing capacity resulting in increased throughput

Improved Usability

This release introduces:

• A quicker, simplified installation process
• A new Package Management system that improves the speed and ease of deploying automation solutions into production
• 180+ new blocks to provide equivalent capability with the most used blocks within 7.X.
• A new Property Editor for configuring blocks, allowing for quicker configuration and better ease of use.
• Messages which reports issues identified with a flow before it is executed
• A new online Product Portal that contains materials regarding the release and how to use the product
• Integration of Cortex Studio with the Product Portal

Improved Security

This release introduces the concept of Encryptable and Encrypted text, allowing for blocks to identify and interact with sensitive data that should/must be encrypted at rest and during data transfer.

Improved Observability

This release introduces:

• Structured logging providing a defined JSON format for logs produced by the Innovation Platform
• Dashboards providing observability of the Innovation Platform in Production; these use structured logs as their source

Other Improvements

This release introduces a number of other improvements, such as:

• Flow Contracts which allow a flow to declare any Input Variables required to run the flow, and what Output Variables will be returned by the flow
• Debugging with Input Variables which allow flow developers to provide required Input Variables when debugging a flow
• Versioned APIs which allow our APIs to evolve in future releases without breaking existing automation solutions

For a full list of what has been introduced in this release, please see the 2022.9 Release Notes

2 - Overview

What is Cortex?

Low-code automation

Cortex is a low-code, automation and orchestration platform, that enables organisations to graphically capture and automate anything from simple tasks, to interactive workflows, to complex IT and business processes that span the entire organisation.

Enterprise-grade

Evolved from process and control engineering for mission-critical environments, Cortex provides enterprise-grade functionality to cover the full automation lifecycle; enabling rapid delivery of automation on-premise or in the cloud, from inception to production, without the need for software development experience.

Built for everyone

Our vision is a world where everyone can automate, and Cortex is being built for everyone, not just software developers, with the goal of removing barriers to entry and putting your people at the heart of your automation.

Comprehensive functionality

With a comprehensive set of functionality and interfaces with 3rd party systems available out-of-the-box, it’s quick and easy to get started on your automation journey.

What can it do?

Deliver quickly

Using Cortex, global organisations have been able to increase their capacity, velocity, quality, efficiency, agility and transform their business and IT operations in months.

Across multiple sectors, industries and markets

Cortex has been deployed in small, medium and large enterprises from different sectors, industries and markets, including:

• Telecommunication services
• IT services
• Banking, Financial Services and Insurance
• Chemicals
• Paper and Forest products
• Food products
• Government
• Media

For diverse sets of use cases

Cortex has been deployed for a diverse set of use cases, including:

• Lights out monitoring and management of fixed-line telephony networks
• Data center provisioning
• Patching of servers
• IT service diagnostics
• Swivel chair operations
• Employee onboarding and offboarding
• Animal welfare compliance checks

Resulting in successful outcomes

Cortex has resulted in many successful outcomes, including:

• Increased revenue
• Increased profit
• Redeployment of skilled employees
• Reduction in MTTR
• Reduction in average handling time

Accelerate your digital transformation

Wherever you are on your automation journey and whatever you are trying to achieve, small or large, simple or complex, Cortex can help accelerate a successful transformation of your operations.

How do I get started?

3 - Getting Started

3.1 - Install On-Premise

3.1.1 - Install Innovation Only

3.1.1.1 - Multiple Server - With HA (Recommended)

3.1.1.1.1 - Architecture

Architecture

Components

Recommended Architecture

The following architecture requires 5 servers:

• 1x Web Application Server which contains Gateway, Flow Debugger Service and Databases
• 1x Load Balancer Server
• 3x Application Servers

Next Steps?

1. Prerequisites

3.1.1.1.2 - Prerequisites

Prerequisites

The prerequisites required for each server role (as described in Architecture) are laid out in this guide. These must be considered before undertaking installation.

Hardware Requirements

Software Requirements

Domain Requirements

All servers must be on the same domain and cannot be domain controllers.

DNS Requirements

The installation requires IP to hostname resolution to be available. Please ensure that you have the appropriate pointer (PTR) records configured on the DNS server for all of your servers (Web, Application and Load Balancer).

Licensing Requirements

A valid Cortex licence file and Cortex Innovation feature identifier must be procured from Cortex. The feature identifier is a GUID which will be used when configuring the Gateway installation. The licence file is needed when installing the Web Application server and it should contain fingerprints for the Web Application Server and each Application Server.

To get a licence file and feature identifier take the following steps:

1. Copy the following template to a text file:

   Web Application Server
   MachineID: 
   Fingerprint: 
   
   Application Server 1
   MachineID: 
   Fingerprint: 
   
   Application Server 2
   MachineID: 
   Fingerprint: 
   
   Application Server 3
   MachineID: 
   Fingerprint: 
   
   Please also include a suitable Cortex Innovation feature identifier.
   

2. Extract Cortex Innovation 2022.9 - Licence Fingerprint Generator.zip.

3. From that folder, copy Cortex.Licensing.FingerprintGeneration.exe to the Web Application server.

4. Double-click Cortex.Licensing.FingerprintGeneration.exe to run it. A command line window will appear, containing a machine identifier and fingerprint, e.g:

   MachineID: WEBAPP-SERVER
   Fingerprint: 111118BA104C928319E0CBAE30844CF8B7FD8BC414D1567844D1D0830089F1C9BF5C6
   

5. Copy the output (machine identifier and fingerprint) to the Web Application Server section of the text file created in the initial step. Note that the machine identifier can be changed to any string, provided that it is different for each server.

6. For each Application Server take the following steps:

   1. Copy Cortex.Licensing.FingerprintGeneration.exe to the Application server.

   2. Double-click Cortex.Licensing.FingerprintGeneration.exe to run it. A command line window will appear, containing a machine identifier and fingerprint, e.g:

      MachineID: APP-SERVER1
      Fingerprint: 111118BA104C928319E0CBAE30844CF8B7FD8BC414D1567844D1D0830089F1C9BF5C6
      

   3. Copy the output (machine identifier and fingerprint) to one of the Application Server sections of the text file created in the initial step. Note that the machine identifier can be changed to any string, provided that it is different for each server.

7. Request a licence and feature identifier by raising a case in the Cortex Service Portal, including the contents of the text file containing all of the fingerprint and machine information in the body of the case.

8. When the licence and feature identifier have arrived, copy the file Cortex.lic to %ProgramData%\Cortex\Licences on the Web Application Server, creating the Cortex and Licences folders if they don’t exist. Save the feature identifier for use when Installing Gateway.

Web Browser Requirements

Gateway supports the latest versions of the following browsers:

• Chrome
• Edge
• Firefox

Additional Load Balancer Server Requirements

Filesystem Requirements

If using the included gobetween load balancer, Network Discovery and File Sharing must be enabled on the Load Balancer Server:

1. Open File Explorer.
2. Click Network on the left.
3. A banner similar to the following will appear if Network Discovery and File Sharing is turned off:

   

4. Click the banner.
5. Click Turn on network discovery and file sharing:

   

Alternative Load Balancer Requirements

Innovation has a gobetween load balancer included that isn’t highly available; It is possible to use an alternative. The requirements for installing an alternative load balancer are as follows:

• Must support a round robin (or similar) method of load balancing to specified ports on 3 nodes.
• Must be able to health check each node by running a predefined batch script (ApiGatewayTypeHealthcheck.bat, which resides in the gobetween folder of the Cortex Innovation 2022.9 - App Server Install Scripts) that returns 1 for healthy and 0 for unhealthy.
• Must be able to access each of the Application Servers via HTTPS.
• Ideally it should be highly available to avoid a single point of failure in the system.

Additional Application Server Requirements

Filesystem Requirements

All Application Servers must use an NTFS filesystem.

Network Discovery and File Sharing should be enabled on each Application Server:

1. Open File Explorer.
2. Click Network on the left.
3. A banner similar to the following will appear if Network Discovery and File Sharing is turned off:

   

4. Click the banner.
5. Click Turn on network discovery and file sharing:

   

Service Requirements

The following Windows Services must be running on all Application Servers:

• Remote Registry
• Windows Event Log
• Performance Logs & Alerts

Security Requirements

Installation User

A domain user which is a member of the Local Administrators group on all Application Servers and Load Balancer Server must be available to run the installation scripts. This is a prerequisite of Microsoft Service Fabric, which is the HA platform that Cortex Innovation is built upon.

Antivirus Exclusions

It is advised (by Microsoft Service Fabric) that the following antivirus exclusions are created on each Application Server to reduce antivirus processing on Service Fabric artefacts:

Folder Exclusions:

• %ProgramFiles%\Microsoft Service Fabric
• %ProgramData%\SF
• %ProgramData%\SF\Logs

Process Exclusions:

• Fabric.exe
• FabricHost.exe
• FabricInstallerService.exe
• FabricSetup.exe
• FabricDeployer.exe
• ImageBuilder.exe
• FabricGateway.exe
• FabricDCA.exe
• FabricFAS.exe
• FabricUOS.exe
• FabricRM.exe
• FileStoreService.exe

A script is provided during installation to add these exclusions for Windows Defender. If any other antivirus software is running, these will need to be added manually.

If adding the exclusions manually, the Process Exclusions should be done before installation occurs, as the processes will be used during installation of the application and antivirus software can cause the installation to fail or timeout. Folder Exclusions may need to be added after installation has occurred as some antivirus software needs the folders to exist.

Port Requirements

Cortex Innovation and Microsoft Service Fabric require a range of firewall ports to be opened between the servers and specific services.

If you are using Windows Firewall, some ports are opened during installation and others are opened dynamically as needed. If any other firewall is used, it will be necessary to add the rules described in Port Requirements to open the correct ports.

The Cortex.Innovation.Test.PortUsage.ps1 script is provided during installation to test the ports on each Application Server and make sure they do not overlap with any other programs; most ports may be altered if this is the case, the description will say if this is not possible.

Certificate Requirements

An X.509 SSL wildcard certificate should be used to:

• Secure communication between the load balancer and the nodes on the Application Servers.
• Secure communication between the Application Services.
• Allow Application Services to identify themselves to clients such as Gateway.
• Prevent unauthorised nodes from joining the HA cluster.
• Connect to Service Fabric Explorer from each of the Application Servers.

The certificate can be obtained from a Certificate Authority, such as Let’s Encrypt, and must meet the following requirements:

• Subject field must be in a wildcard format, pertaining to the domain of the Application Servers (e.g. CN=*.domain.com).
• Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service.
• Certificate file must be in a .PFX file format, with a known password.
• Certificate file must contain the full chain of certificates.
• Certificate file must include the private key.
• Key Usage extension must have a value of Digital Signature, Key Encipherment (a0).
• Enhanced Key Usage must include Server Authentication and Client Authentication.

This file should be placed in a known location on the Application Server where the installation scripts will be run. This location will be required when running the installation script.

If required, a separate X.509 SSL certificate can be obtained to be used by the load balancer to communicate with the Application Services. It must meet all of the other requirements laid out above, except the subject field can also be the FQDN of the load balancer (e.g. CN=machine-name.domain.com).

TLS Requirements

There is a set of non-compulsory security measures, recommended to be applied to the Application Servers, in order to prevent potential attacks that exploit known industry security vulnerabilities. This includes disabling all versions of SSL and TLS apart from TLS 1.2. And disabling all cipher suites apart from the following:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

See SSL Best Practices for a full list of the security changes which will be applied. The Cortex.Innovation.Install.Multiple.SSLBestPractices.ps1 script is provided during installation to apply these security changes to the Application Servers.

Additional Web Application Server Requirements

Security Requirements

Installation User

Domain users must be available to run the Application Pools for Gateway and Flow Debugger Service. These users must be given Log on as a service and Log on as a batch job permissions otherwise the Application Pools will not be able to run. Information about how to do this will be given during installation.

For Flow Debugger Service, the NETWORK SERVICE user can also be used.

Domain Requirements

For Gateway, only Windows domains with an Active Directory domain controller running Active Directory Domain Services are supported.

Supported versions of Active Directory are listed below:

Certificate Requirements

Both Gateway and the Flow Debugger Service require an X.509 SSL certificate to be installed on the Web Application Server. The certificate must have the following properties:

• Enhanced Key Usage: Server Authentication and Client Authentication
• Subject Alternative Names (SAN): At minimum the FQDN of the Server. It can also include NetBIOS Name, IP address, localhost, 127.0.0.1

If the user tries to navigate to an address not in the SAN list, then they will receive a certificate error.

Wildcard certificates and self-signed certificates can also be used. However, self-signed certificates are not recommended for production instances. Details on how to create a self-signed certificate can be found at Create Self-Signed Certificates.

The certificate may be the same one used for the Application Server installation.

More information about importing the certificate is given during installation.

TLS Requirements

There is a set of non-compulsory security measures, recommended to be applied to the Web Application Server, in order to prevent potential attacks that exploit known industry security vulnerabilities. This includes disabling all versions of SSL and TLS apart from TLS 1.2. And disabling all cipher suites apart from the following:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

See SSL Best Practices for a full list of the security changes which will be applied. The Cortex.Innovation.Install.SSLBestPractices.ps1 script is provided during installation to apply these security changes to the Web Application Server.

Next Steps?

1. Install Application Servers and Load Balancer

3.1.1.1.3 - Install Application Servers and Load Balancer

Install Application Servers and Load Balancer

This guide describes how to install the Application Servers and Load Balancer Server. Please ensure that the Prerequisites for installing Innovation have been read before starting this installation.

Make Installation Artefacts Available

1. Choose one of the Application Servers to be used for installation, and copy the following artefacts to a folder on it (the version numbers may differ):

   • Cortex Innovation 2022.9 - Block Packages.zip
   • Cortex Innovation 2022.9 - App Services.zip
   • Cortex Innovation 2022.9 - App Server Install Scripts.zip

2. Extract the Cortex Innovation 2022.9 - App Server Install Scripts.zip file to a folder with the same name.

Install Microsoft .NET Framework 4.7.1

Microsoft Service Fabric requires a minimum of Microsoft .NET Framework 4.7.1 to be installed on each Application Server.

To find the version of the framework that is installed:

1. On the Start menu, choose Run.
2. In the open box, enter regedit.exe. You must have administrative credentials to run regedit.exe.
3. In the Registry Editor, open the subkey HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full.
4. If the Full subkey is not present, then you do not have the .NET Framework 4.5 or later installed.
5. Check for a DWORD value named Release. The existence of the Release DWORD indicates the .NET Framework 4.5 or newer has been installed on that computer. If the value is 461308 or over then at least .NET Framework 4.7.1 is installed and no further steps need to be taken. If it is not installed, continue with the following steps to install it.

To install .NET Framework 4.7.1:

1. Download the .NET Framework 4.7.1 installer.
2. Double-click on the installer file to run it.
3. Follow the wizard to complete the installation.

Apply Recommended Security Measures

These are non-compulsory security measures, recommended to be applied to Application Servers and the Load Balancer Server, in order to prevent potential attacks that exploit known industry security vulnerabilities.

Applying these measures may impact other applications running on your servers. Therefore, it is your responsibility to ensure that other applications and their clients will not be affected by the changes.

Only Use Recommended Encryption Algorithms and TLS Protocols

A collection of registry settings need to be applied to guarantee your server is only using the recommended encryption algorithms and TLS protocols. Information about these settings can be found at SSL Best Practices.

The settings can be applied by running a script. Be aware that each server will be restarted when the script is run. Apply the settings by following these instructions:

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - App Server Install Scripts"
   

3. Run the Cortex.Innovation.Install.Multiple.SSLBestPractices.ps1 script using the following command, modifying the ApplicationServers value to contain the NETBIOS names or fully qualified domain names of the Application Servers and the LoadBalancerServer value to contain the NETBIOS names or fully qualified domain name of the Load Balancer Server (remove the LoadBalancerServer parameter if using an alternative load balancer):

   .\Cortex.Innovation.Install.Multiple.SSLBestPractices.ps1 -ApplicationServers @("app-server1", "app-server2", "app-server3") -LoadBalancerServer "lb-server"
   

   Note

   To avoid answering all of the prompts -Override 0 can be added to the end of the script. This will automatically apply all settings and forcibly restart the servers.

4. A credentials prompt will appear. Enter credentials of a domain user that is a member of the local Administrators group on all servers (Application and Load Balancer) and press OK.

   If -Override 0 has been specified no further steps need to be taken and you can move on to the next section when the servers have restarted.

5. To use all the recommended settings click Apply all to the each Apply Cortex recommended security best practices prompt.

   To selectively apply each setting select Choose which to apply. Each change will then be prompted with a Yes/No confirmation before applying. This will need to be done for each server.

6. Restart each machine when the script asks. The current machine will be restarted last, the PowerShell script will close at this time.

Add Antivirus Exclusions

1. If Windows Defender is not running on the Application Servers, ensure that the Antivirus Exclusions have been added to the running antivirus software on each of the Application Servers and continue to the next section, otherwise follow these steps:

   1. Open a Windows PowerShell (x64) window as administrator.

   2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - App Server Install Scripts folder using the following command, modifying the path as necessary:

      cd "C:\Install\Cortex Innovation 2022.9 - App Server Install Scripts"
      

   3. Run the Cortex.Innovation.Add.WindowsDefenderExclusions.ps1 script using the following command, modifying the ApplicationServers value to contain the NETBIOS names or fully qualified domain names of the Application Servers:

      .\Cortex.Innovation.Add.WindowsDefenderExclusions.ps1 -ApplicationServers @("app-server1", "app-server2", "app-server3")
      

   4. A credentials prompt will appear. Enter credentials of a domain user that is a member of the local Administrators group on all Application Servers and press OK.

   5. A message will indicate that the script has completed successfully.

Check Port Usage

1. To check all necessary ports are free, follow these steps.

   1. Open a Windows PowerShell (x64) window as administrator.

   2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - App Server Install Scripts folder using the following command, modifying the path as necessary:

      cd "C:\Install\Cortex Innovation 2022.9 - App Server Install Scripts"
      

   3. Run the Cortex.Innovation.Test.PortUsage.ps1 script using the following command, modifying the ApplicationServers value to contain the NETBIOS names or fully qualified domain names of the Application Servers:

      .\Cortex.Innovation.Test.PortUsage.ps1 -ApplicationServers @("app-server1", "app-server2", "app-server3")
      

   4. A credentials prompt will appear. Enter credentials of a domain user that is a member of the local Administrators group on all Application Servers and press OK.

   5. If all ports are free, the script will report the following for each Application Server:

      All ports required by Cortex Innovation are free

      If this is the case, continue to the next section. Otherwise, consult the messages returned by the script, which will give details about how to modify the Cortex.Innovation.Install.Config.json configuration file, in the Cortex Innovation 2022.9 - App Server Install Scripts folder, to use different ports. This will be used later during installation.

      The Cortex.Innovation.Test.PortUsage.ps1 script cannot currently re-check modified ports in the configuration file so these need to be manually checked to see that they are free.

Configure Installation Script

1. In the Cortex Innovation 2022.9 - App Server Install Scripts folder, locate the Cortex.Innovation.Install.ps1 script and open it with a text editor.

2. Choose the tab below that matches the configuration for this installation, then update the script to match, changing the parameters according to the details given below:

   • CA Certs, Built-in Load Balancer
   • Self-Signed Certs, Built-in Load Balancer
   • CA Certs, Alternative Load Balancer
   • Self-Signed Certs, Alternative Load Balancer

   
   .\Cortex.Install.ps1 -ConfigFileName Cortex.Innovation.Install.Config.json `
       -AppServicesPath "C:\Install\Cortex Innovation 2022.9 - App Services.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -ApiGatewayBasicAuthUserName "BasicAuthUser" `
       -ApiGatewayBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -CustomerName "Customer1" `
       -ApplicationServerIPv4Addresses @("192.168.1.1", "192.168.1.2", "192.168.1.3") `
       -LoadBalancerServerIPv4Address "192.168.1.4" `
       -ServerCertificatePath "C:\Install\Certificates\cert.pfx" `
       -ServerCertificatePwd "myPassword" `
       -ClientCertificatePath "C:\Install\Certificates\cert.pfx" `
       -ClientCertificatePwd "myPassword" `
       -Credential $Credential `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-ha-install-log.txt"
           

   
       .\Cortex.Install.ps1 -ConfigFileName Cortex.Innovation.Install.Config.json `
       -AppServicesPath "C:\Install\Cortex Innovation 2022.9 - App Services.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -ApiGatewayBasicAuthUserName "BasicAuthUser" `
       -ApiGatewayBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -CustomerName "Customer1" `
       -ApplicationServerIPv4Addresses @("192.168.1.1", "192.168.1.2", "192.168.1.3") `
       -LoadBalancerServerIPv4Address "192.168.1.4" `
       -UseSelfSignedCertificates `
       -Credential $Credential `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-ha-install-log.txt"
           

   
   .\Cortex.Install.ps1 -ConfigFileName Cortex.Innovation.Install.Config.json `
       -AppServicesPath "C:\Install\Cortex Innovation 2022.9 - App Services.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -ApiGatewayBasicAuthUserName "BasicAuthUser" `
       -ApiGatewayBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -CustomerName "Customer1" `
       -ApplicationServerIPv4Addresses @("192.168.1.1", "192.168.1.2", "192.168.1.3") `
       -ServerCertificatePath "C:\Install\Certificates\cert.pfx" `
       -ServerCertificatePwd "myPassword" `
       -ClientCertificatePath "C:\Install\Certificates\cert.pfx" `
       -ClientCertificatePwd "myPassword" `
       -SkipLoadBalancer `
       -Credential $Credential `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-ha-install-log.txt"
           

   
   .\Cortex.Install.ps1 -ConfigFileName Cortex.Innovation.Install.Config.json `
       -AppServicesPath "C:\Install\Cortex Innovation 2022.9 - App Services.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -ApiGatewayBasicAuthUserName "BasicAuthUser" `
       -ApiGatewayBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -CustomerName "Customer1" `
       -ApplicationServerIPv4Addresses @("192.168.1.1", "192.168.1.2", "192.168.1.3") `
       -UseSelfSignedCertificates `
       -SkipLoadBalancer `
       -Credential $Credential `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-ha-install-log.txt"
           

   Name	Description
   AppServicesPath	Configure this value with the location of the Application Services zip file on the Application Server used for installation.
   BlockPackagesPath	Configure this value with the location of the Block Packages zip file on the Application Server used for installation.
   ApiGatewayBasicAuthUserName	Configure this value with the username that will be used for Basic Authentication when making HTTPS requests to the API Gateway Service (e.g. starting production flows). For security reasons it is recommended that the default value BasicAuthUser should be changed. Currently only Basic Authentication using a single user is supported, OAuth2 will be supported in a future release. This value will be needed later, when installing Gateway.
   ApiGatewayBasicAuthPwd	Configure this value with the password that will be used for Basic Authentication when making HTTPS requests to the API Gateway Service (e.g. starting production flows). This password should be Cortex Encrypted. For security reasons it is recommended that the default value ADA9883B11BD4CDC908B8131B57944A4 should be changed. This value will be needed later, when installing Gateway.
   CustomerName	A name identifying the platform being installed. This must have no spaces or symbols. It will be appended to the node names that are displayed in Service Fabric Explorer.
   ApplicationServerIPv4Addresses	The IPv4 addresses of the Application Servers. The first of these must be the Application Server used for installation.
   LoadBalancerServerIPv4Address	The IPv4 address of the Load Balancer Server. This is only needed if using the built-in load balancer.
   ServerCertificatePath	The local path of a .PFX certificate file on the first Application Server in the ApplicationServerIPv4Addresses list. Environment variables cannot be used. This is only needed if installing with CA Certificates (Recommended). The certificate should meet the Certificate Requirements. This certificate will be used for: Securing communication between the Application Services. Allowing Application Services to identify themselves to clients such as Gateway. Preventing unauthorised nodes from joining the HA cluster. Connecting to Service Fabric Explorer from each of the Application Servers. Warning It is critical to set a reminder to update certificates in good time before they expire. If they expire then the platform will cease to function and Cortex Service Portal must be contacted for support.
   ServerCertificatePwd	The password for the .PFX certificate file specified in ServerCertificatePath. This is only needed if installing with CA Certificates (Recommended).
   ClientCertificatePath	The local path of a .PFX certificate file on the first Application Server in the ApplicationServerIPv4Addresses list. This can be the same certificate as the ServerCertificatePath. Environment variables cannot be used. This is only needed if installing with CA Certificates (Recommended) and using the Built-In Load Balancer. The certificate should meet the Certificate Requirements. This certificate will be used for: Securing communication between the load balancer and the nodes on the Application Servers. Warning It is critical to set a reminder to update certificates in good time before they expire. If they expire then the platform will cease to function and Cortex Service Portal must be contacted for support.
   ClientCertificatePwd	The password for the .PFX certificate file specified in ClientCertificatePath. This is only needed if installing with CA Certificates (Recommended) and using the Built-In Load Balancer.
   UseSelfSignedCertificates	Installs Application Services and required infrastructure using generated Self-Signed Certificates rather than CA Certificates. Not recommended for production use.
   SkipLoadBalancer	Installs Application Services and required infrastructure without installing a load balancer. Use when using an alternative load balancer or no load balancer.
   Credential	The credentials of the user which will be used to perform remote operations on the Application Servers. It must be a domain user that is a member of the local Administrators group on all servers. This does not need to be changed, a prompt will appear to enter this information when the script is run.
   AcceptEULA	This does not need to be changed, the EULA will be accepted at a later stage.
   FilePath	The filename that installation logs are written to. If this should be written to a different location than where the installation files are then a full path should be specified.

   The ApiGatewayBasicAuthUserName and ApiGatewayBasicAuthPwd will be needed later, when installing Gateway.

   Note

   More advanced configuration (such as changing ports) can be undertaken by modifying the Cortex.Innovation.Install.Config.json file but this shouldn’t be required for most installations. More information about this can be found at Advanced Application Server and Load Balancer Configuration Changes.

3. Save and close Cortex.Innovation.Install.ps1.

Test Installation Script

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - App Server Install Scripts"
   

3. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.ps1 -WhatIf
   

4. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -WhatIf -AcceptEULA
   

5. Run the PowerShell command to test the installation script.

6. A credentials prompt will appear. Enter credentials of a domain user that is a member of the local Administrators group on all servers (Application and Load Balancer) and press OK.

7. A password prompt will appear. Enter a password which will be used to create a user in RabbitMQ.

8. Wait for the command to finish. It will display the output of the installation command without making any changes to the system, to ensure things like communication between the servers are working.

9. Check that there have been no errors in the script; these would appear in red in the console.

   If there are no errors, continue to the next section; otherwise, check if the errors have any instructions for rectifying the issue and follow them.

   If there are no useful instructions, check that all previous steps have been followed correctly and, if not, rectify it and run the command again.
   
   If this does not work, please contact Cortex Service Portal for further assistance. The WhatIf script will have created a temporary version of the config file in the script location, showing what changes would be made to it when the script runs. The name is appended with -WhatIf (e.g. Cortex.Innovation.Install.Config-WhatIf.json). This file can be provided when obtaining support.

Run Installation Script

1. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.ps1
   

2. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -AcceptEULA
   

3. Run the PowerShell command to install HA Services and the required infrastructure.

4. A credentials prompt will appear. Enter credentials of a domain user that is a member of the local Administrators group on all servers (Application and Load Balancer) and press OK.

5. A password prompt will appear. Enter a password which will be used to create a user in RabbitMQ. This should be entered carefully and recorded as it may be needed if seeking support from Cortex Service Portal. Press OK.

6. Wait for the script to finish running. This should take approximately 10 minutes.

7. Check that there have been no errors in the script; these would appear in red in the console.

   If there are any errors, then please follow any instructions given within them to rectify the situation, check your configuration files, and retry the installation.

   In some circumstances, retrying may error due to components being installed already. In this case please run the following command, followed by the original installation command:

   .\Cortex.Innovation.Uninstall.ps1
   

   If the errors do not give any instructions on how to rectify, see Troubleshooting During Installation for further information; if this does not help then please contact Cortex Service Portal for assistance.

Check Application Services

1. Log on to one of the Application Servers.

2. Import the client certificate, used in the ClientCertificatePath parameter of the Configure Installation Script section, to your Current User certificate store. This can be achieved by double clicking on the client certificate .PFX file and following the wizard.

   If using self-signed certificates, the certificate can be retrieved by using the Manage Computer Certificates tool in Windows to export the CortexServerCertificate from the Personal store and then importing it to the Current User store by double-clicking on it and following the wizard.

3. Open a web browser.

4. Navigate to https://app-server.domain.com:9080/Explorer, where app-server.domain.com is the fully qualified domain name of any Application Server. Replace 9080 with new httpGatewayEndpointPort value if it was changed during configuration.

   The screen should resemble that in the following figure:

   

   The status circles should be entirely green - this indicates that all nodes, services and instances are healthy. Other status pages can be accessed by expanding items in the leftmost pane. Issues can be tracked down to the failing component by expanding items with warning triangles or error icons on. The next few diagrams show the status pages for a healthy system.

   After expanding the application, clicking on any of the services should display a green circle and Status = Active:

   

   After expanding either of the services, clicking on any of the instances/partitions should display a green circle and Status = Ready:

   

   Clicking on any of the nodes at the bottom of the leftmost pane should display a green circle and Status = Up:

   

   If any warning triangles appear, wait for 5 minutes or so as the cluster may still be starting up. If the cluster looks OK, go to the next section.

   If the warnings persist or anything on the screen goes red, expand the items to find the individual services and instances which have errors or warnings. Warnings should not be ignored as they can indicate that the service can’t start but is still in the retry phase. Error and warning messages should be displayed on the status screens and should indicate what is wrong.

   If no useful message can be seen here, the service log files may contain more information. These can be found on each Application Server at:

   • %ProgramData%/Cortex/Cortex API Gateway Service
   • %ProgramData%/Cortex/Cortex Flow Execution Service

   If no solution can be found, please contact Cortex Service Portal for further assistance.

Preserve installation files

Ensure that the installation files are backed up or kept on the server, especially the scripts and config files that have been modified. This will make it easier to perform further actions in future, such as troubleshooting, certificate rollover, uninstallation, reinstallation and updates.

Next Steps?

1. Install Web Application Server

3.1.1.1.4 - Install the Web Application Server

Install the Web Application Server

This guide describes how to install the Web Application Server. Please ensure that Install Application Servers and Load Balancer has been completed before starting this installation.

Make Installation Artefacts Available

1. We recommend that the Flow Debugger Service and Gateway are installed on the same Web Application Server. Copy the following artefacts to a folder on the machine (the version numbers may differ):

   • Cortex Innovation 2022.9 - Block Packages.zip
   • Cortex Innovation 2022.9 - Gateway.zip
   • Cortex Innovation 2022.9 - Flow Debugger Service.zip
   • Cortex Innovation 2022.9 - Web App Server Install Scripts.zip

2. Extract the Cortex Innovation 2022.9 - Web App Server Install Scripts.zip zip file to a folder with the same name.

Install Prerequisites

Licensing

Ensure that a valid Cortex licence file named Cortex.lic exists on the Web Application server, in the location %ProgramData%\Cortex\Licences. If it does not, follow the instructions located at Licensing Requirements.

Install SQL Server or SQL Express

1. Use one of the following installation guides to install SQL Server or SQL Server Express:
   • Cortex Innovation - SQL Server 2019 Installation Guide
   • Cortex Innovation - SQL Server 2016 Installation Guide
   • Cortex Innovation - SQL Server 2016 Express Installation Guide

Install Microsoft .NET Framework 4.7.1

Gateway requires a minimum of Microsoft .NET Framework 4.7.1.

To find the version of the framework that is installed:

1. On the Start menu, choose Run.
2. In the open box, enter regedit.exe. You must have administrative credentials to run regedit.exe.
3. In the Registry Editor, open the subkey HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full.
4. If the Full subkey is not present, then you do not have the .NET Framework 4.5 or later installed.
5. Check for a DWORD value named Release. The existence of the Release DWORD indicates the .NET Framework 4.5 or newer has been installed on that computer. If the value is 461308 or over then at least .NET Framework 4.7.1 is installed and no further steps need to be taken. If it is not installed, continue with the following steps to install it.

To install .NET Framework 4.7.1:

1. Download the .NET Framework 4.7.1 installer.
2. Double-click on the installer file to run it.
3. Follow the wizard to complete the installation.

Install Microsoft Web Deploy

1. Check if Web Deploy is already installed by going to Control Panel → Programs → Programs and Features; if Web Deploy is already installed, it will be listed as Microsoft Web Deploy.
2. If it is not installed, download Microsoft Web Deploy version 3.0 or later (WebDeploy_amd64_en-US.exe) to the server.
3. Double-click the downloaded file to start the installation.
4. Follow the installation wizard to install Web Deploy; on the Choose Setup Type page select Typical.

Install Visual C++ Redistributable

1. Check if Visual C++ 2013 Redistributable (x64) is already installed by going to Control Panel → Programs → Programs and Features; if Visual C++ Redistributable is already installed, it will be listed as Microsoft Visual C++ 2013 Redistributable (x64).
2. If it is not installed, download Visual C++ Redistributable 2013 (x64).
3. Double-click the downloaded file to start the installation.
4. Follow the installation wizard to install the Visual C++ Redistributable.

Install Certificate

Both Gateway and the Flow Debugger Service require an X.509 SSL certificate to be installed on the Web Application Server. The certificate must have the following properties:

• Enhanced Key Usage: Server Authentication and Client Authentication
• Subject Alternative Names (SAN): At minimum the FQDN of the Server. It can also include NetBIOS Name, IP address, localhost, 127.0.0.1

If the user tries to navigate to an address not in the SAN list, then they will receive a certificate error.

Wildcard certificates and self-signed certificates can also be used. However, self-signed certificates are not recommended for production instances. Details on how to create a self-signed certificate can be found at Create Self-Signed Certificates.

You can import the certificate by right clicking the certificate file, selecting Install Certificate and following the wizard. When prompted, ensure you import it into the Local Machine store and not Current User.

To verify the certificate is imported:

1. Click the Windows button (Start)
2. Type certlm.msc and press Enter to open the Certificate Manager dialog
3. Expand Personal and select Certificates
4. You should see your certificate in this store

IIS Role Setup and Configuration

Install Internet Information Services (IIS)

Install the required features by following these instructions:

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - Web App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - Web App Server Install Scripts"
   

3. Run the Cortex.Innovation.Install.WindowsFeatures.ps1 script using the following command, this may take a few minutes:

   .\Cortex.Innovation.Install.WindowsFeatures.ps1
   

4. Check the output is as follows:

   Web-WebSockets is installed
   Web-Asp-Net45 is installed
   Web-Net-Ext45 is installed
   Web-ISAPI-Ext is installed
   Web-ISAPI-Filter is installed
   Net-Framework-45-Core is installed
   Net-Framework-45-ASPNET is installed
   Web-Default-Doc is installed
   Web-Dir-Browsing is installed
   Web-Http-Errors is installed
   Web-Static-Content is installed
   Web-Http-Logging is installed
   Web-Http-Redirect is installed
   Web-Request-Monitor is installed
   Web-Stat-Compression is installed
   Web-Dyn-Compression is installed
   Web-Filtering is installed
   Web-Windows-Auth is installed
   Web-Mgmt-Console is installed
   Web-Mgmt-Service is installed
   

Register and Allow .NET CLR v4.0.30319 with IIS

1. Open a Windows PowerShell (x64) window as administrator.

2. Run the following command:

   Dism /online /enable-feature /featurename:IIS-ASPNET45 /all
   

3. Once PowerShell confirms that it has finished installing .NET CLR v4.0.30319, close the PowerShell window.

Install URL Rewrite Module

The URL Rewrite IIS Manager module is required to enable web applications on your server to rewrite URLs. This is needed to allow HTTP URLs to redirect to the equivalent HTTPS ones.

To install the URL Rewrite module take the following steps:

1. In the left-hand pane of Internet Information Service (IIS) Manager, select the server node.
2. Ensure that there is an icon with the title URL Rewrite under the IIS feature section:

   

3. If there is an icon, URL Rewrite module is installed and no further steps are required.
4. If there is no icon, the module is not installed and the following steps must be taken:
   1. Download the URL Rewrite module installer.
   2. Double-click on the installer file to run it.
   3. Follow the wizard to complete the installation.
   4. After successfully installing, close and reopen IIS Manager. The URL Rewrite icon should now be visible.

Apply Recommended Security Measures

These are non-compulsory security measures, recommended to be applied to Web Application Servers, in order to prevent potential attacks that exploit known industry security vulnerabilities.

Applying these measures may impact other applications running on your server. Therefore, it is your responsibility to ensure that other applications and their clients will not be affected by the changes.

Only Use Recommended Encryption Algorithms and TLS Protocols

A collection of registry settings need to be applied to guarantee your server is only using the recommended encryption algorithms and TLS protocols. Information about these settings can be found at SSL Best Practices.

Apply the settings by following these instructions:

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - Web App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - Web App Server Install Scripts"
   

3. Run the Cortex.Innovation.Install.SSLBestPractices.ps1 script using the following command:

   .\Cortex.Innovation.Install.SSLBestPractices.ps1
   

   Note

   To avoid answering all of the prompts -Override 0 can be added to the end of the script. This will automatically apply all settings and forcibly restart the server.

   If -Override 0 has been specified no further steps need to be taken and you can move on to the next section when the server has restarted.

4. To use all the recommended settings click Apply all to the first prompt.

   To selectively apply each setting select Choose which to apply. Each change will then be prompted with a Yes/No confirmation before applying.

5. Restart the machine when the script asks.

Add HTTPS Firewall Rule

If any firewall is running on the Web Application Server, it must be configured to allow communication inbound via TCP on the port configured for HTTPS (usually 443). See Configure Firewalls for information about adding rules to Windows Firewall.

Create Web Site

Gateway and Flow Debugger Service can either be installed to an existing web site or a newly created web site. If you are installing into an existing web site skip to Configure Web Site.

The steps to create a new web site are:

1. In Windows File Explorer, navigate to the default IIS folder (usually %SystemDrive%\inetpub\wwwroot, e.g. C:\inetpub\wwwroot).
2. Ensure there is a folder called Cortex; if not create it.
3. In the left-hand pane of Internet Information Service (IIS) Manager, expand the server node.
4. Right-click the Sites node under the server and select Add Website….
5. Set the Site name to Cortex.
6. Set the Physical path to the folder created above (e.g. C:\inetpub\wwwroot\Cortex), by clicking on the ellipses …, selecting the appropriate directory and clicking OK.
7. Click OK. If an existing site is already using the specified port, a warning will be displayed. Either click No and change the Port in the Add Website dialog, or click Yes and stop the other website.

Configure Web Site

The web site which the Gateway and Flow Debugger Service are installed under requires additional configuration.

Configure HTTPS

Both the Gateway and Flow Debugger Service should be configured to use HTTPS:

1. In the left-hand pane of Internet Information Service (IIS) Manager, expand the server node.
2. Expand the Sites node under the server.
3. Right-click the web site where Gateway will be installed and select Edit Bindings….
4. Click Add…
5. Set Type to https.
6. Set the appropriate Port number (typically 443). The Host name box can be left blank.

   Note

   Configuring your system to use a port other than the HTTPS default of 443 is not compatible with HTTP Strict Transport Security (HSTS). If your configuration requires HTTPS to run on a port other than 443, the HSTS configuration must be turned off. This can be achieved by configuring the Add Strict-Transport-Security when HTTPS rewrite rule’s enabled setting to false in web.config after installation.
7. Select the SSL certificate that was installed in the Install Certificate section.
8. Click OK. If an existing site is already using the specified SSL port, a warning will be displayed. Either click No and change the Port in the Add Site Binding dialog, or click Yes and stop the other website.
9. It is recommended to remove the http site binding.

Install Flow Debugger Service

Get Application Pool User

A domain user account is required for the Flow Debugger Service web application pool and must be created prior to performing the installation. In line with best practices, this account should not be used for any purposes other than those specified for the Flow Debugger Service. Alternatively, the NETWORK SERVICE user may also be used.

This user must currently have access to the default NuGet directory, in order to load block packages correctly. To add permissions for the user take the following steps:

1. Navigate to %SystemRoot%\System32\config\systemprofile\AppData\Roaming\ and create a new folder named NuGet if one does not exist.
2. Right-click on the NuGet folder and click Properties.
3. In the dialog, click the Security tab.
4. Click the Edit... button.
5. Click the Add... button.
6. Enter the username of the application pool user and click OK.
7. In the Permissions section at the bottom, check Full control
8. Click OK.

The user must be given Log on as a service and Log on as a batch job permissions. To do this take the following steps:

1. Navigate to Start -> Administrative Tools -> Local Security Policy.
2. In the Local Security Policy dialog, expand the Local Policies node then select User Rights Assignment.
3. Take the following steps for the Log on as a service and Log on as a batch job policies:
   1. In the right-hand panel, double-click on the policy.
   2. In the Properties dialog, click on the Add User or Group button.

      Note

      It is possible to use the Advanced… button to look up names rather than entering them manually. Various filters can be set to find the correct user or group more easily. Multiple users can be selected by holding down CTRL while clicking. OK adds the selected users or groups into the Enter the object names to select text box.
   3. Type the name of the application pool user account into the Enter the object names to select text box. Click the Check Names button to confirm that the user exists.
   4. Click OK on the Select Users dialog, and then confirm the user is correct by clicking OK on the Properties dialog.

Configure Installation Script

1. In the Cortex Innovation 2022.9 - Web App Server Install Scripts folder, locate the Cortex.Innovation.Install.FlowDebuggerService.ps1 script and open it with a text editor.

2. Choose the tab below that matches the configuration for this installation, then update the script to match, changing the parameters according to the details given below:

   • CA Certs
   • Self-Signed Certs

   
   .\Cortex.Install.FlowDebuggerService.ps1 `
       -FlowDebuggerServicePath "C:\Install\Cortex Innovation 2022.9 - Flow Debugger Service.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -FlowDebuggerBasicAuthUserName "BasicAuthUser" `
       -FlowDebuggerBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -Credential $AppPoolIdentity `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-flow-debugger-service-install-log.txt"
           

   
   .\Cortex.Install.FlowDebuggerService.ps1 `
       -FlowDebuggerServicePath "C:\Install\Cortex Innovation 2022.9 - Flow Debugger Service.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -FlowDebuggerBasicAuthUserName "BasicAuthUser" `
       -FlowDebuggerBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -UseSelfSignedCertificates `
       -Credential $AppPoolIdentity `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-flow-debugger-service-install-log.txt"
           

   Name	Description
   FlowDebuggerServicePath	Configure this value with the location of the Flow Debugger Service zip file on the Web Application Server.
   BlockPackagesPath	Configure this value with the location of the Block Packages zip file on the Web Application Server.
   FlowDebuggerBasicAuthUserName	Configure this value with the username that will be used for Basic Authentication when Gateway makes HTTPS requests to the Flow Debugger Service. For security reasons it is recommended that the default value BasicAuthUser should be changed. Currently only Basic Authentication using a single user is supported, OAuth2 will be supported in a future release. This value will be needed later, when installing Gateway.
   FlowDebuggerBasicAuthPwd	Configure this value with the password that will be used for Basic Authentication when Gateway makes HTTPS requests to the Flow Debugger Service. This password should be Cortex Encrypted. For security reasons it is recommended that the default value ADA9883B11BD4CDC908B8131B57944A4 should be changed. This value will be needed later, when installing Gateway.
   UseSelfSignedCertificates	Enables Flow Debugger Service to communicate with Gateway using generated Self-Signed Certificates rather than CA Certificates. Not recommended for production use.
   Credential	The credentials of the user that will be used to run the Debugger application pool in IIS. This does not need to be changed, a prompt will appear to enter this information when the script is run.
   AcceptEULA	This does not need to be changed, the EULA will be accepted at a later stage.
   FilePath	The filename that installation logs are written to. If this should be written to a different location than where the installation files are then a full path should be specified.

3. Save and close Cortex.Innovation.Install.FlowDebuggerService.ps1.

Run Installation Script

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - Web App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - Web App Server Install Scripts"
   

3. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.FlowDebuggerService.ps1
   

4. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -AcceptEULA
   

5. Run the PowerShell command to install the Flow Debugger Service.

6. A credentials prompt will appear. Enter the credentials of the user that should run the Debugger application pool in IIS. If using the NETWORK SERVICE user, enter any user as the username and leave the password blank; the NETWORK SERVICE user will need to be selected in the final step.

7. Wait for the script to finish running. This should take approximately 2 minutes.

8. An error may have appeared saying:

   The Windows Process Activation Service service is not started.
   

   This can be ignored.

9. Check that there have been no other errors in the script; these would appear in red in the console.

   If there are any errors, then please follow any instructions given within them to rectify the situation, and retry the installation.

   If the errors do not give any instructions on how to rectify, please contact Cortex Service Portal for further assistance.

10. If using NETWORK SERVICE for the application pool user:

    1. Open Internet Information Services (IIS) Manager.
    2. On the left, expand the server node.
    3. Click Application Pools.
    4. Right-click on the Debugger application pool and select Advanced Settings....
    5. In the Advanced Settings dialog, click on Identity and then click the ellipses (...).
    6. In the Application Pool Identity dialog, select Built-in account, then select NetworkService from the drop-down, then click OK.
    7. Right-click on the Debugger application pool and click Recycle....

Install Gateway

Get Application Pool User

A domain user account is required for the Gateway web application pool and must be created prior to performing the installation below.

This user account is required to enable Gateway to access the Cortex database, with the following roles:

• dbcreator
• public

To add roles to database users take the following steps:

1. Open SQL Server Management Studio on the Web Application Server and log in.

2. Expand the server node, then Security then Logins.

3. If the user that will run the Gateway application pool is not in the list of logins, take the following steps, otherwise skip to step 4:

   1. Right-click the Logins node and click New Login....
   2. Enter the application pool user in the Login name box.
   3. On the left pane, click Server Roles.
   4. Check public and dbcreator
   5. Click OK.

4. If the user that will run the Gateway application pool is in the list of logins, take the following steps:

   1. Right-click on the application pool user.
   2. Click Properties.
   3. On the left pane, click Server Roles.
   4. Check public and dbcreator.
   5. Click OK.

In line with best practices, this account should not be given administrator rights, nor should it be used for any purposes other than those specified for Gateway.

The user must be given Log on as a service and Log on as a batch job permissions. To do this take the following steps:

1. Navigate to Start -> Administrative Tools -> Local Security Policy.
2. In the Local Security Policy dialog, expand the Local Policies node then select User Rights Assignment.
3. Take the following steps for the Log on as a service and Log on as a batch job policies:
   1. In the right-hand panel, double-click on the policy.
   2. In the Properties dialog, click on the Add User or Group button.

      Note

      It is possible to use the Advanced… button to look up names rather than entering them manually. Various filters can be set to find the correct user or group more easily. Multiple users can be selected by holding down CTRL while clicking. OK adds the selected users or groups into the Enter the object names to select text box.
   3. Type the name of the application pool user account into the Enter the object names to select text box. Click the Check Names button to confirm that the user exists.
   4. Click OK on the Select Users dialog, and then confirm the user is correct by clicking OK on the Properties dialog.

Create Gateway Application Pool

1. Open Internet Information Services (IIS) Manager.
2. Select and right-click the Application Pools node under the server and select Add Application Pool…
3. Set Name to Cortex Gateway.
4. Ensure that the .NET CLR version is set to .NET CLR Version v4.0.30319 (This may be configured by default).
5. Ensure that the Managed pipeline mode is set to Integrated (This may be configured by default).
6. Click OK
7. Right click on the created application pool and select Advanced Settings…
8. Click the ... next to Identity (under Process Model) to open a dialog, then select Custom Account and Set....
9. Enter the username and password for the user identified in Get Application Pool User.
10. Click OK to close the Set Credentials dialog.
11. Click OK to close the Application Pool Identity dialog.
12. Click OK to close the Advanced Settings dialog.

Create New Web Application

1. In the left-hand pane of Internet Information Service (IIS) Manager, expand the server node.
2. Right-click on the site the application should be installed under and select Add Application…
3. Set the Alias to gateway. This must be lowercase.
4. Click Select… and from the Application pool dropdown select the Cortex Gateway application pool and click OK.
5. Set the Physical path to C:\inetpub\wwwroot\Cortex\Gateway by clicking on the ellipses … and selecting the appropriate directory. Create the C:\inetpub\wwwroot\Cortex\Gateway directory if it does not already exist.
6. Click OK.

Configure IIS Site Redirect to the Specified Web Application (Optional)

If the site hosting the Gateway web application is a newly created Cortex site or an existing site that doesn’t have its own content, it is recommended to redirect the site URL to the gateway web application URL, e.g. https://FullyQualifiedDomainName to https://FullyQualifiedDomainName/gateway.

1. Open Internet Information Services (IIS) Manager.
2. Select the site hosting the gateway web application and from IIS settings double-click the HTTP Redirect icon.
3. Click the check box Redirect requests to this destination.
4. Enter https://FullyQualifiedDomainName/gateway, replacing FullyQualifiedDomainName with the FQDN of the server.
5. In the Redirect Behaviour section, click Only redirect requests to content in this directory (not subdirectories).
6. In Actions click the Apply button.

Configure Installation Script

1. In the Cortex Innovation 2022.9 - Web App Server Install Scripts folder, locate the Cortex.Innovation.Install.Gateway.ps1 script and open it with a text editor.

2. Configure the script according to the details given below:

   .\Cortex.Install.Gateway.ps1 `
   -GatewayPackagePath "C:\Install\Cortex Innovation 2022.9 - Gateway.zip" `
   -GatewayApplicationIISPath "Cortex\gateway" `
   -ModelDBContextConnectionString "Data Source=localhost;Initial Catalog=CortexWeb;Integrated Security=True;MultipleActiveResultSets=True" `
   -AuthContextConnectionString "Data Source=localhost;Initial Catalog=CortexWeb.Auth;Integrated Security=True;MultipleActiveResultSets=True" `
   -SignalRContextConnectionString "Data Source=localhost;Initial Catalog=CortexWeb.SignalR;Integrated Security=True;MultipleActiveResultSets=True" `
   -FeatureFlags "InnovationId" `
   -ServiceFabricApiGatewayEndpoint "https://server.domain.com/" `
   -ServiceFabricUsingSelfSignedCertificates $false `
   -ServiceFabricApiGatewayBasicAuthUsername "BasicAuthUser" `
   -ServiceFabricApiGatewayBasicAuthPassword "ADA9883B11BD4CDC908B8131B57944A4" `
   -DotNetFlowDebuggerEndpoint "https://server.domain.com/debugger/api/" `
   -DotNetFlowDebuggerBasicAuthUsername "BasicAuthUser" `
   -DotNetFlowDebuggerBasicAuthPassword "ADA9883B11BD4CDC908B8131B57944A4" `
   -DotNetFlowDebuggerUsingSelfSignedCertificates $false `
   -Test:$Test `
   -AcceptEULA:$AcceptEula `
   *>&1 | Tee-Object -FilePath "cortex-gateway-install-log.txt"
   

   Name	Description
   GatewayPackagePath	Configure this value with the location of the Cortex Innovation 2022.9 - Gateway.zip file on the installation server.
   GatewayApplicationIISPath	Change to the correct Site Name/Application if either was modified from the defaults (Cortex/gateway) when creating the website or application.
   ModelDBContextConnectionString	If SQL Server was installed as the default instance, change the Data Sourcein the connection string to localhost or, if it was installed on another machine, change it to the machine name. If SQL Server was installed as a named instance, change it to .\{instanceName} replacing {instanceName} with the name of the instance or, if SQL Server was installed on a different machine, change it to {machineName}\{instanceName} replacing {machineName} with the machine name and {instanceName} with the name of the instance. This will set the ModelDBContextConnectionString value in the Gateway web.config.
   AuthContextConnectionString	If SQL Server was installed as the default instance, change the Data Sourcein the connection string to localhost or, if it was installed on another machine, change it to the machine name. If SQL Server was installed as a named instance, change it to .\{instanceName} replacing {instanceName} with the name of the instance or, if SQL Server was installed on a different machine, change it to {machineName}\{instanceName} replacing {machineName} with the machine name and {instanceName} with the name of the instance. This will set the AuthContextConnectionString value in the Gateway web.config.
   SignalRContextConnectionString	If SQL Server was installed as the default instance, change the Data Sourcein the connection string to localhost or, if it was installed on another machine, change it to the machine name. If SQL Server was installed as a named instance, change it to .\{instanceName} replacing {instanceName} with the name of the instance or, if SQL Server was installed on a different machine, change it to {machineName}\{instanceName} replacing {machineName} with the machine name and {instanceName} with the name of the instance. This will set the SignalRContextConnectionString value in the Gateway web.config.
   FeatureFlags	Replace InnovationId with the Cortex Innovation feature identifier, which should have been provided by Cortex when fulfilling the Licensing Requirements, if it wasn’t it should be requested using Cortex Service Portal. This will set the FeatureFlags value in the Gateway web.config.
   ServiceFabricApiGatewayEndpoint	Replace server.domain.com with the fully qualified domain name of the Load Balancer Server. The port should be specified if it is not the default HTTPS port (443), and there must be a trailing slash, e.g. https://server.domain.com/ or https://server.domain.com:8722/. This will set the ServiceFabricApiGatewayEndpoint value in the Gateway web.config.
   ServiceFabricUsingSelfSignedCertificates	Configure the value as $false if you used valid CA certificates when installing the Application Servers, $true if you used self-signed certificates. This will set the ServiceFabricUsingSelfSignedCertificates value in the Gateway web.config.
   ServiceFabricApiGatewayBasicAuthUsername	This must be changed if you used a non-default ApiGatewayBasicAuthUserName when installing the Application Servers; if so, this value must be configured to the one used. This will set the ServiceFabricApiGatewayBasicAuthUsername value in the Gateway web.config.
   ServiceFabricApiGatewayBasicAuthPassword	This must be changed if you used a non-default ApiGatewayBasicAuthPassword when installing the Application Servers; if so, this value must be configured to the one used. It can be Cortex Encrypted. This will set the ServiceFabricApiGatewayBasicAuthPassword value in the Gateway web.config.
   DotNetFlowDebuggerEndpoint	Replace server.domain.com with the fully qualified domain name of the Web Application Server. This will set the DotNetFlowDebuggerEndpoint value in the Gateway web.config.
   DotNetFlowDebuggerBasicAuthUsername	This must be changed if you used a non-default FlowDebuggerBasicAuthUserName when installing the Flow Debugger Service; if so, this value must be configured to the one used. This will set the DotNetFlowDebuggerBasicAuthUsername value in the Gateway web.config.
   DotNetFlowDebuggerBasicAuthPassword	This must be changed if you used a non-default FlowDebuggerBasicAuthPassword when installing the Flow Debugger Service; if so, this value must be configured to the one used. It can be Cortex Encrypted. This will set the DotNetFlowDebuggerBasicAuthPassword value in the Gateway web.config.
   DotNetFlowDebuggerUsingSelfSignedCertificates	Configure the value as $false if you are using valid CA certificates to secure the site containing Gateway and Flow Debugger Service, $true if using self-signed certificates. This will set the DotNetFlowDebuggerUsingSelfSignedCertificates value in the Gateway web.config.
   Test	This does not need to be changed, it will be set at a later stage.
   AcceptEULA	This does not need to be changed, the EULA will be accepted at a later stage.
   FilePath	The filename that installation logs are written to. If this should be written to a different location than where the installation files are then a full path should be specified.

3. Save and close Cortex.Innovation.Install.Gateway.ps1.

Test Installation Script

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - Web App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - Web App Server Install Scripts"
   

3. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.Gateway.ps1 -Test
   

4. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -Test -AcceptEULA
   

5. Run the PowerShell command to test the configuration. In the event of any errors, there will be an error message displayed at the end of the output with a line confirming the Error Count.

Run Installation Script

1. Ensure the Gateway application pool is stopped:

   1. Open Internet Information Service (IIS) Manager.
   2. In the left pane, expand the server node.
   3. Click Application Pools to display a list of the Application Pools.
   4. Right-click the Cortex Gateway application pool and select Stop.

   Note

   Failure to stop the application pool will result in a permissions error when installing Gateway.

2. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.Gateway.ps1
   

3. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -AcceptEULA
   

4. Run the PowerShell command to install Gateway. In the event of any errors, there will be an error message displayed at the end of the output with a line confirming the Error Count.

5. Ensure that the user identified in Get Application Pool User has Full control access to the Gateway folder created in Create New Web Application:

   1. Navigate to C:\inetpub\wwwroot\Cortex\.
   2. Right-click the Gateway folder and click Properties.
   3. In the Gateway Properties dialog, click the Security tab.
   4. Click the user identified in Get Application Pool User within the Group or user names section.
   5. In the Permissions section, ensure the user has Full control checked. If not:
      1. Click the Edit... button.
      2. Select the user identified in Get Application Pool User within the Group or user names section.
      3. In the Permissions section, check Full control.
      4. Click OK, then wait for Windows Security to update the security information to the folder.
      5. Click OK.

6. Start the Gateway application pool:

   1. Open Internet Information Service (IIS) Manager.
   2. In the left pane, expand the server node.
   3. Click Application Pools to display a list of the Application Pools.
   4. Right-click the Cortex Gateway application pool and select Start.

7. Once the application pool has been started, the site will be available on <protocol>://<host>:<port>/<webapplicationname>, e.g. https://localhost/gateway.

   Note

   If the application pool does not stay started, ensure that the user it runs as has Log on as a service and Log on as a batch job permissions or belongs to a group that has those permissions.

Preserve installation files

Ensure that the installation files are backed up or kept on the server, especially the scripts and config files that have been modified. This will make it easier to perform further actions in future, such as troubleshooting, certificate rollover, uninstallation, reinstallation and updates.

Next Steps?

1. Setup Gateway

3.1.1.1.5 - Setup Gateway

Setup Gateway

This guide describes how to setup Gateway. Please ensure that Install Web Application Server has been completed before taking these steps.

Gateway Initial Setup

Log on to Gateway and run through the setup wizard:

1. Open a supported web browser and navigate to <protocol>://<host>:<port>/<webapplicationname>, e.g. https://localhost/gateway.

   If an error message is displayed in the browser, wait a few minutes and refresh the page as it is possible that the website was still starting.

2. Log on using the default credentials that Gateway deploys with:

   Username: administrator

   Password: Adm1n1strat0r

3. On a newly installed system, you will be presented with a Setup Wizard at this point, which will guide you through some basic configuration steps:

   • Account Details
   • LDAP Connection
   • LDAP Authorisation

4. Follow the steps in the setup wizard to configure the relevant areas:

   Account Details

   1. Click Next Step:

      

   2. Enter an email address for the Administrator and click Next Step:

      

   3. Change the Administrator password to a unique, secret password and click Next Step:

      

   LDAP Connection

   1. Enter the details of your Active Directory server and provide a Username and Password for a user with read access to it:

      A connection to an Active Directory server must be established in order to assign authorisation rights to users.

      1. In the Server field, enter the Hostname, FQDN or IP Address of the Active Directory server that Gateway should use to authenticate and authorise users.
      2. In the Port field, enter the port number of the Active Directory server. The well-known port for LDAP traffic is 389; if SSL encryption is used, the well-known port is 636.
      3. If an SSL connection is to be used, tick the box Use SSL.
      4. In the Username field, enter a valid username of a user that has read permissions for the Active Directory server.
      5. In the Password field, enter the password of the user entered in the previous step.
      6. To reduce the scope of any Active Directory searches, add one or more base DNs (Distinguished Names). For each base DN click Add and enter the full LDAP path e.g CN=group, OU=organisational unit, DC=domain, DC=com. These will be used as the roots of any Active Directory searches performed. For more information about distinguished names see https://msdn.microsoft.com/en-us/library/aa366101(v=vs.85).aspx.

   2. Click Test Connection to validate the connection and the user credentials entered and click Next Step.

   

   LDAP Authorisation

   1. If the authorisation grid fails to load first time round, click Retry.

   2. Assign access permissions to Active Directory groups:

      To allow users to access the various roles within Gateway, it is first necessary to assign them the appropriate access rights. Gateway currently supports four roles, but only two are relevant for Cortex Innovation:

      • Admin
      • Studio

      To give a user access to a role, set access for a group or Organisational Unit (OU) that the user is a member of:

      1. Expand the groups or OUs, or search for the group or OU, to be assigned one or more roles.
      2. Check the relevant roles for each group. Checking a parent group will cascade the setting to all child groups.

      

   3. Click Complete Setup to commit the changes.

   4. To test the permissions, log out as Administrator and then log in as a user with Studio permissions.

Configure the Gateway Databases to use Transparent Data Encryption

Once Gateway has been configured, if you wish to encrypt the databases using Transparent Data Encryption for improved security, this should now be performed by following the steps in Configuring TDE.

Next Steps?

1. Try it out

3.1.1.1.6 - Try it out

Try it out

This guide describes how to try out a new Innovation installation to make sure it is working. Please ensure that Setup Gateway has been completed before taking these steps.

Test Debugging Flows

Test the platform by creating a new flow and executing it using the following steps:

1. Click on the Flows charm, then the + button and click Group to open a dialog.
2. Enter a name for the group, configure the Permission Groups and click OK to create the group.
3. Click on the group to open it (refresh the page if it does not appear).
4. Inside the group, click the + button again and click on Flow to open a dialog. If the menu item is not present, it means that the FeatureFlags in the CortexGateway.SetParameters.xml file was not set properly when installing Gateway. See Troubleshooting for more information.
5. Enter a name for the flow, configure the Permission Groups and click OK to create the flow.
6. The flow should be displayed with a start flow block and end flow block. A list of block palettes should be displayed down the left hand side:

   

   If the blocks in the flow do not display or the palettes are not visible, see Troubleshooting for more information.
7. Add a Set Variable block and connect it between the start and end blocks.
8. Click the Set Variable block to open the Property Editor.
9. Set the Value property to the expression DateTimeOffset.Now.
10. Type Result into the Variable property and click Create Result.
11. In the Variable Editor, set Is Output Variable? to true for the new Result variable.
12. Set a breakpoint on the end block and start the flow. An execution token should appear, the Result variable should show the current time. If the token does not appear, try refreshing the page.
13. Continue or stop the execution.
14. Commit the flow.

Test Publishing Production Flows

1. Log in to Gateway with a user that has the Admin role.
2. Click on the Settings charm, then Packages.
3. Click Add Package Definition. Enter a package name and select the new flow to add to the package. Click Save to save the new package.
4. Click Publish. A success message should appear. If it doesn’t it means that either one or more of the parameters prefixed with Service Fabric in the CortexGateway.SetParameters.xml file was not set properly when installing Gateway, or the Application Services aren’t healthy. See Troubleshooting for more information.

Test Executing Production Flows

1. Open an HTTP client, such as Postman. Make a request with the following format:

   Property	Value
   Action	POST
   URL	https://{FQDN of Load Balancer Server}/api/default/default/flows/{Flow Name}/executions?packageName={Package Name} e.g. https://load-balancer.domain.com/api/default/default/flows/NewFlow/executions?packageName=NewPackage
   Content Type	application/json
   Body	{}
   Authentication	Basic
   Username	The value used for ApiGatewayBasicAuthUserName when installing Application Services
   Password	The value used for ApiGatewayBasicAuthPwd when installing Application Services (Unencrypted)

   Note

   If you used self-signed certificates when installing the Application Servers you will need to disable SSL certificate validation in your HTTP client.

2. The request should return a JSON object with the output variables of the flow e.g. { "Output": "2022-03-09T07:35:16+0000" }.

3. Cortex Innovation has now been verified and is ready to use.

3.1.1.2 - Single Server - Without HA

3.1.1.2.1 - Architecture

Architecture

Components

Single Server Architecture

The following architecture requires 1 server:

Next Steps?

1. Prerequisites

3.1.1.2.2 - Prerequisites

Prerequisites

The prerequisites required for a single server (as described in Architecture) are laid out in this guide. These must be considered before undertaking installation.

Hardware Requirements

Software Requirements

Domain Requirements

The server must be on a domain and cannot be a domain controller.

DNS Requirements

The installation requires IP to hostname resolution to be available. Please ensure that you have the appropriate pointer (PTR) records configured on the DNS server for the server.

Licensing Requirements

A valid Cortex licence file and Cortex Innovation feature identifier must be procured from Cortex. The feature identifier is a GUID which will be used when configuring the Gateway installation. The licence file is needed when installing the server and it should contain that server’s fingerprint.

To get a licence file and feature identifier take the following steps:

1. Copy the following template to a text file:

   Web Application/Application Server
   MachineID: 
   Fingerprint: 
   
   Please also include a suitable Cortex Innovation feature identifier.
   

2. Extract Cortex Innovation 2022.9 - Licence Fingerprint Generator.zip.

3. From that folder, copy Cortex.Licensing.FingerprintGeneration.exe to the server.

4. Double-click Cortex.Licensing.FingerprintGeneration.exe to run it. A command line window will appear, containing a machine identifier and fingerprint, e.g:

   MachineID: SERVER
   Fingerprint: 111118BA104C928319E0CBAE30844CF8B7FD8BC414D1567844D1D0830089F1C9BF5C6
   

5. Copy the output (machine identifier and fingerprint) to the Web Application/Application Server section of the text file created in the initial step. Note that the machine identifier can be changed to any string.

6. Request a licence and feature identifier by raising a case in the Cortex Service Portal, including the contents of the text file containing all of the fingerprint and machine information in the body of the case.

7. When the licence and feature identifier have arrived, copy the file Cortex.lic to %ProgramData%\Cortex\Licences on the Web Application Server, creating the Cortex and Licences folders if they don’t exist. Save the feature identifier for use when Installing Gateway.

Web Browser Requirements

Gateway supports the latest versions of the following browsers:

• Chrome
• Edge
• Firefox

Certificate Requirements

An X.509 SSL certificate (standard or wildcard) should be used to:

• Allow Application Services to identify themselves to clients such as Gateway.
• Prevent unauthorised nodes from joining the single node cluster.
• Connect to Service Fabric Explorer from the Application Server.
• Connect to Gateway.
• Allow Gateway to connect to the Flow Debugger Service.

The certificate can be obtained from a Certificate Authority, such as Let’s Encrypt, and must meet the following requirements:

• Subject field must be in one of the following formats, depending on the certificate type:
  • Standard certificates must use the standard format (e.g. CN=host.domain.com).
  • Wildcard certificates must use the wildcard format, pertaining to the domain of the server (e.g. CN=*.domain.com).
• Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service.
• Subject Alternative Names (SAN): At minimum the FQDN of the server. It can also include NetBIOS Name, IP address, localhost, 127.0.0.1. It must include any additional host names that should be able to be used to access the API Gateway Service.
• Certificate file must be in a .PFX file format, with a known password.
• Certificate file must contain the full chain of certificates.
• Certificate file must include the private key.
• Key Usage extension must have a value of Digital Signature, Key Encipherment (a0).
• Enhanced Key Usage must include Server Authentication and Client Authentication.

This file should be placed in a known location on the server. This location will be required when running the Application Server installation script.

TLS Requirements

There is a set of non-compulsory security measures, recommended to be applied to the server, in order to prevent potential attacks that exploit known industry security vulnerabilities. This includes disabling all versions of SSL and TLS apart from TLS 1.2, and disabling all cipher suites apart from the following:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

See SSL Best Practices for a full list of the security changes which will be applied. The Cortex.Innovation.Install.SSLBestPractices.ps1 script is provided during installation to apply these security changes to the server.

Additional Application Server Requirements

Filesystem Requirements

The server must use an NTFS filesystem.

Service Requirements

The following Windows Services must be running on the server:

• Remote Registry
• Windows Event Log
• Performance Logs & Alerts

Security Requirements

Installation User

A domain user which is a member of the Local Administrators group on the server must be available to run the installation scripts. This is a prerequisite of Microsoft Service Fabric, which is the platform that Cortex Innovation is built upon.

Antivirus Exclusions

It is advised (by Microsoft Service Fabric) that the following antivirus exclusions are created on the server to reduce antivirus processing on Service Fabric artefacts:

Folder Exclusions:

• %ProgramFiles%\Microsoft Service Fabric
• %ProgramData%\SF
• %ProgramData%\SF\Logs

Process Exclusions:

• Fabric.exe
• FabricHost.exe
• FabricInstallerService.exe
• FabricSetup.exe
• FabricDeployer.exe
• ImageBuilder.exe
• FabricGateway.exe
• FabricDCA.exe
• FabricFAS.exe
• FabricUOS.exe
• FabricRM.exe
• FileStoreService.exe

A script is provided during installation to add these exclusions for Windows Defender. If any other antivirus software is running, these will need to be added manually.

If adding the exclusions manually, the Process Exclusions should be done before installation occurs, as the processes will be used during installation of the application and antivirus software can cause the installation to fail or timeout. Folder Exclusions may need to be added after installation has occurred as some antivirus software needs the folders to exist.

Port Requirements

Cortex Innovation and Microsoft Service Fabric require a range of firewall ports to be opened between the server and specific services.

If you are using Windows Firewall, some ports are opened during installation and others are opened dynamically as needed. If any other firewall is used, it will be necessary to add the rules described in Port Requirements to open the correct ports.

The Cortex.Innovation.Test.PortUsage.ps1 script is provided during installation to test the ports on the server and make sure they do not overlap with any other programs; most ports may be altered if this is the case, the description will say if this is not possible.

Additional Web Application Server Requirements

Security Requirements

Installation User

Domain users must be available to run the Application Pools for Gateway and Flow Debugger Service. These users must be given Log on as a service and Log on as a batch job permissions otherwise the Application Pools will not be able to run. Information about how to do this will be given during installation.

For Flow Debugger Service, the NETWORK SERVICE user can also be used.

Domain Requirements

For Gateway, only Windows domains with an Active Directory domain controller running Active Directory Domain Services are supported.

Supported versions of Active Directory are listed below:

Next Steps?

1. Install Application Server

3.1.1.2.3 - Install Application Server

Install Application Server

This guide describes how to install the Application Server components on the server. Please ensure that the Prerequisites have been read before starting this installation.

Make Installation Artefacts Available

1. Copy the following artefacts to a folder on the server (the version numbers may differ):

   • Cortex Innovation 2022.9 - Block Packages.zip
   • Cortex Innovation 2022.9 - App Services.zip
   • Cortex Innovation 2022.9 - App Server Install Scripts.zip

2. Extract the Cortex Innovation 2022.9 - App Server Install Scripts.zip file to a folder with the same name.

Install Microsoft .NET Framework 4.7.1

Microsoft Service Fabric requires a minimum of Microsoft .NET Framework 4.7.1 to be installed on the server.

To find the version of the framework that is installed:

1. On the Start menu, choose Run.
2. In the open box, enter regedit.exe. You must have administrative credentials to run regedit.exe.
3. In the Registry Editor, open the subkey HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full.
4. If the Full subkey is not present, then you do not have the .NET Framework 4.5 or later installed.
5. Check for a DWORD value named Release. The existence of the Release DWORD indicates the .NET Framework 4.5 or newer has been installed on that computer. If the value is 461308 or over then at least .NET Framework 4.7.1 is installed and no further steps need to be taken. If it is not installed, continue with the following steps to install it.

To install .NET Framework 4.7.1:

1. Download the .NET Framework 4.7.1 installer.
2. Double-click on the installer file to run it.
3. Follow the wizard to complete the installation.

Apply Recommended Security Measures

These are non-compulsory security measures, recommended to be applied to the server, in order to prevent potential attacks that exploit known industry security vulnerabilities.

Applying these measures may impact other applications running on your server. Therefore, it is your responsibility to ensure that other applications and their clients will not be affected by the changes.

Only Use Recommended Encryption Algorithms and TLS Protocols

A collection of registry settings need to be applied to guarantee your server is only using the recommended encryption algorithms and TLS protocols. Information about these settings can be found at SSL Best Practices.

The settings can be applied by running a script. Be aware that the server will be restarted when the script is run. Apply the settings by following these instructions:

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - App Server Install Scripts"
   

3. Run the Cortex.Innovation.Install.SSLBestPractices.ps1 script using the following command:

   .\Cortex.Innovation.Install.SSLBestPractices.ps1
   

   Note

   To avoid answering all of the prompts -Override 0 can be added to the end of the script. This will automatically apply all settings and forcibly restart the server.

   If -Override 0 has been specified no further steps need to be taken and you can move on to the next section when the server has restarted.

4. To use all the recommended settings click Apply all to the first prompt.

   To selectively apply each setting select Choose which to apply. Each change will then be prompted with a Yes/No confirmation before applying.

5. Restart the machine when the script asks.

Add Antivirus Exclusions

1. If Windows Defender is not running on the server, ensure that the Antivirus Exclusions have been added to the running antivirus software on the server and continue to the next section, otherwise follow these steps:

   1. Open a Windows PowerShell (x64) window as administrator.

   2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - App Server Install Scripts folder using the following command, modifying the path as necessary:

      cd "C:\Install\Cortex Innovation 2022.9 - App Server Install Scripts"
      

   3. Run the Cortex.Innovation.Add.WindowsDefenderExclusions.ps1 script using the following command, modifying the ApplicationServers value to contain the NETBIOS name or fully qualified domain name of the server:

      .\Cortex.Innovation.Add.WindowsDefenderExclusions.ps1 -ApplicationServers @("app-server1")
      

   4. A credentials prompt will appear. Enter credentials of a domain user that is a member of the local Administrators group on the server and press OK.

   5. A message will indicate that the script has completed successfully.

Check Port Usage

1. To check all necessary ports are free, follow these steps.

   1. Open a Windows PowerShell (x64) window as administrator.

   2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - App Server Install Scripts folder using the following command, modifying the path as necessary:

      cd "C:\Install\Cortex Innovation 2022.9 - App Server Install Scripts"
      

   3. Run the Cortex.Innovation.Test.PortUsage.ps1 script using the following command, modifying the ApplicationServers value to contain the NETBIOS name or fully qualified domain name of the server:

      .\Cortex.Innovation.Test.PortUsage.ps1 -ApplicationServers @("app-server1")
      

   4. A credentials prompt will appear. Enter credentials of a domain user that is a member of the local Administrators group on the server and press OK.

   5. If all ports are free, the script will report the following:

      All ports required by Cortex Innovation are free

      If this is the case, continue to the next section. Otherwise, consult the messages returned by the script, which will give details about how to modify the Cortex.Innovation.Install.Config.json configuration file, in the Cortex Innovation 2022.9 - App Server Install Scripts folder, to use different ports. This will be used later during installation.

      The Cortex.Innovation.Test.PortUsage.ps1 script cannot currently re-check modified ports in the configuration file so these need to be manually checked to see that they are free.

Configure Installation Script

1. In the Cortex Innovation 2022.9 - App Server Install Scripts folder, locate the Cortex.Innovation.Install.ps1 script and open it with a text editor.

2. Choose the tab below that matches the configuration for this installation, then update the script to match, changing the parameters according to the details given below:

   • CA Certs
   • Self-Signed Certs

   
   .\Cortex.Install.ps1 -ConfigFileName Cortex.Innovation.Install.Config.json `
       -AppServicesPath "C:\Install\Cortex Innovation 2022.9 - App Services.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -ApiGatewayBasicAuthUserName "BasicAuthUser" `
       -ApiGatewayBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -CustomerName "Customer1" `
       -ApplicationServerIPv4Addresses @("192.168.1.1") `
       -ServerCertificatePath "C:\Install\Certificates\cert.pfx" `
       -ServerCertificatePwd "myPassword" `
       -SkipLoadBalancer `
       -Credential $Credential `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-app-install-log.txt"
           

   
   .\Cortex.Install.ps1 -ConfigFileName Cortex.Innovation.Install.Config.json `
       -AppServicesPath "C:\Install\Cortex Innovation 2022.9 - App Services.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -ApiGatewayBasicAuthUserName "BasicAuthUser" `
       -ApiGatewayBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -CustomerName "Customer1" `
       -ApplicationServerIPv4Addresses @("192.168.1.1") `
       -UseSelfSignedCertificates `
       -SkipLoadBalancer `
       -Credential $Credential `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-app-install-log.txt"
           

   Name	Description
   AppServicesPath	Configure this value with the location of the App Services zip file on the server.
   BlockPackagesPath	Configure this value with the location of the Block Packages zip file on the server.
   ApiGatewayBasicAuthUserName	Configure this value with the username that will be used for Basic Authentication when making HTTPS requests to the API Gateway Service (e.g. starting production flows). Currently only Basic Authentication using a single user is supported, OAuth2 will be supported in a future release. This value will be needed later, when installing Gateway.
   ApiGatewayBasicAuthPwd	Configure this value with the password that will be used for Basic Authentication when making HTTPS requests to the API Gateway Service (e.g. starting production flows). This should be Cortex Encrypted. This value will be needed later, when installing Gateway.
   CustomerName	A name identifying the platform being installed. This must have no spaces or symbols. It will be appended to the node names that are displayed in Service Fabric Explorer.
   ApplicationServerIPv4Addresses	The IPv4 address of the server.
   ServerCertificatePath	The local path of a .PFX certificate file on the server. Environment variables cannot be used. This is only needed if installing with CA Certificates (Recommended). The certificate should meet the Certificate Requirements. This certificate will be used for: Securing communication between the Application Services. Allowing Application Services to identify themselves to clients such as Gateway. Preventing unauthorised nodes from joining the single node cluster. Connecting to Service Fabric Explorer from each of the Application Servers. Warning It is critical to set a reminder to update certificates in good time before they expire. If they expire then the platform will cease to function and Cortex Service Portal must be contacted for support.
   ServerCertificatePwd	The password for the .PFX certificate file specified in ServerCertificatePath. This is only needed if installing with CA Certificates (Recommended).
   UseSelfSignedCertificates	Installs Application Services and required infrastructure using generated Self-Signed Certificates rather than CA Certificates. Not recommended for production use.
   SkipLoadBalancer	Installs Application Services and required infrastructure without installing a load balancer.
   Credential	The credentials of the user which will be used to perform remote operations on the server. It must be a domain user that is a member of the local Administrators group on the server. This does not need to be changed, a prompt will appear to enter this information when the script is run.
   AcceptEULA	This does not need to be changed, the EULA will be accepted at a later stage.
   FilePath	The filename that installation logs are written to. If this should be written to a different location than where the installation files are then a full path should be specified.

   The ApiGatewayBasicAuthUserName and ApiGatewayBasicAuthPwd will be needed later, when installing Gateway.

   Note

   More advanced configuration (such as changing ports) can be undertaken by modifying the Cortex.Innovation.Install.Config.json file but this shouldn’t be required for most installations. More information about this can be found at Advanced Application Server and Load Balancer Configuration Changes.

3. Save and close Cortex.Innovation.Install.ps1.

Test Installation Script

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - App Server Install Scripts"
   

3. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.ps1 -WhatIf
   

4. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -WhatIf -AcceptEULA
   

5. Run the PowerShell command to test the installation script.

6. A credentials prompt will appear. Enter credentials of a domain user that is a member of the local Administrators group on the server and press OK.

7. A password prompt will appear. Enter a password which will be used to create a user in RabbitMQ.

8. Wait for the command to finish. It will display the output of the installation command without making any changes to the system.

9. Check that there have been no errors in the script; these would appear in red in the console.

   If there are no errors, continue to the next section; otherwise, check if the errors have any instructions for rectifying the issue and follow them.

   If there are no useful instructions, check that all previous steps have been followed correctly and, if not, rectify it and run the command again.
   
   If this does not work, please contact Cortex Service Portal for further assistance. The WhatIf script will have created a temporary version of the config file in the script location, showing what changes would be made to it when the script runs. The name is appended with -WhatIf (e.g. Cortex.Innovation.Install.Config-WhatIf.json). This file can be provided when obtaining support.

Run Installation Script

1. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.ps1
   

2. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -AcceptEULA
   

3. Run the PowerShell command to install HA Services and the required infrastructure.

4. A credentials prompt will appear. Enter credentials of a domain user that is a member of the local Administrators group on the server and press OK.

5. A password prompt will appear. Enter a password which will be used to create a user in RabbitMQ. This should be entered carefully and recorded as it may be needed if seeking support from Cortex Service Portal. Press OK.

6. Wait for the script to finish running. This should take approximately 10 minutes.

7. Check that there have been no errors in the script; these would appear in red in the console.

   If there are any errors, then please follow any instructions given within them to rectify the situation, check your configuration files, and retry the installation.

   In some circumstances, retrying may error due to components being installed already. In this case please run the following command, followed by the original installation command:

   .\Cortex.Innovation.Uninstall.ps1 -SkipLoadBalancer
   

   If the errors do not give any instructions on how to rectify, see Troubleshooting During Installation for further information; if this does not help then please contact Cortex Service Portal for assistance.

Check Application Services

1. Log on to the server.

2. Import the certificate, used in the ServerCertificatePath parameter of the Configure Installation Script section, to your Current User certificate store. This can be achieved by double clicking on the certificate .PFX file and following the wizard.

   If using self-signed certificates, the certificate can be retrieved by using the Manage Computer Certificates tool in Windows to export the CortexServerCertificate from the Personal store and then importing it to the Current User store by double-clicking on it and following the wizard.

3. Open a web browser.

4. Navigate to https://server.domain.com:9080/Explorer, where server.domain.com is the fully qualified domain name of the server. Replace 9080 with new httpGatewayEndpointPort value if it was changed during configuration.

   The screen should resemble that in the following figure:

   

   The status circles should be entirely green - this indicates that the node and all services and instances are healthy. Other status pages can be accessed by expanding items in the leftmost pane. Issues can be tracked down to the failing component by expanding items with warning triangles or error icons on. The next few diagrams show the status pages for a healthy system.

   After expanding the application, clicking on any of the services should display a green circle and Status = Active:

   

   After expanding either of the services, clicking on any of the instances/partitions should display a green circle and Status = Ready:

   

   Clicking on any of the nodes at the bottom of the leftmost pane should display a green circle and Status = Up:

   

   If any warning triangles appear, wait for 5 minutes or so as the cluster may still be starting up. If the cluster looks OK, go to the next section.

   If the warnings persist or anything on the screen goes red, expand the items to find the individual services and instances which have errors or warnings. Warnings should not be ignored as they can indicate that the service can’t start but is still in the retry phase. Error and warning messages should be displayed on the status screens and should indicate what is wrong.

   If no useful message can be seen here, the service log files may contain more information. These can be found on the server at:

   • %ProgramData%/Cortex/Cortex API Gateway Service
   • %ProgramData%/Cortex/Cortex Flow Execution Service

   If no solution can be found, please contact Cortex Service Portal for further assistance.

Preserve installation files

Ensure that the installation files are backed up or kept on the server, especially the scripts and config files that have been modified. This will make it easier to perform further actions in future, such as troubleshooting, certificate rollover, uninstallation, reinstallation and updates.

Next Steps?

1. Install Web Application Server

3.1.1.2.4 - Install the Web Application Server

Install the Web Application Server

This guide describes how to install the Web Application Server components on the server. Please ensure that Install Application Server has been completed before starting this installation.

Make Installation Artefacts Available

1. Copy the following artefacts to a folder on the server (the version numbers may differ):

   • Cortex Innovation 2022.9 - Block Packages.zip
   • Cortex Innovation 2022.9 - Gateway.zip
   • Cortex Innovation 2022.9 - Flow Debugger Service.zip
   • Cortex Innovation 2022.9 - Web App Server Install Scripts.zip

2. Extract the Cortex Innovation 2022.9 - Web App Server Install Scripts.zip zip file to a folder with the same name.

Install Prerequisites

Licensing

Ensure that a valid Cortex licence file named Cortex.lic exists on the server, in the location %ProgramData%\Cortex\Licences. If it does not, follow the instructions located at Licensing Requirements.

Install SQL Server or SQL Express

1. Use one of the following installation guides to install SQL Server or SQL Server Express:
   • Cortex Innovation - SQL Server 2019 Installation Guide
   • Cortex Innovation - SQL Server 2016 Installation Guide
   • Cortex Innovation - SQL Server 2016 Express Installation Guide

Install Microsoft .NET Framework 4.7.1

Gateway requires a minimum of Microsoft .NET Framework 4.7.1.

To find the version of the framework that is installed:

1. On the Start menu, choose Run.
2. In the open box, enter regedit.exe. You must have administrative credentials to run regedit.exe.
3. In the Registry Editor, open the subkey HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full.
4. If the Full subkey is not present, then you do not have the .NET Framework 4.5 or later installed.
5. Check for a DWORD value named Release. The existence of the Release DWORD indicates the .NET Framework 4.5 or newer has been installed on that computer. If the value is 461308 or over then at least .NET Framework 4.7.1 is installed and no further steps need to be taken. If it is not installed, continue with the following steps to install it.

To install .NET Framework 4.7.1:

1. Download the .NET Framework 4.7.1 installer.
2. Double-click on the installer file to run it.
3. Follow the wizard to complete the installation.

Install Microsoft Web Deploy

1. Check if Web Deploy is already installed by going to Control Panel → Programs → Programs and Features; if Web Deploy is already installed, it will be listed as Microsoft Web Deploy.
2. If it is not installed, download Microsoft Web Deploy version 3.0 or later (WebDeploy_amd64_en-US.exe) to the server.
3. Double-click the downloaded file to start the installation.
4. Follow the installation wizard to install Web Deploy; on the Choose Setup Type page select Typical.

Install Visual C++ Redistributable

1. Check if Visual C++ 2013 Redistributable (x64) is already installed by going to Control Panel → Programs → Programs and Features; if Visual C++ Redistributable is already installed, it will be listed as Microsoft Visual C++ 2013 Redistributable (x64).
2. If it is not installed, download Visual C++ Redistributable 2013 (x64).
3. Double-click the downloaded file to start the installation.
4. Follow the installation wizard to install the Visual C++ Redistributable.

IIS Role Setup and Configuration

Install Internet Information Services (IIS)

Install the required features by following these instructions:

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - Web App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - Web App Server Install Scripts"
   

3. Run the Cortex.Innovation.Install.WindowsFeatures.ps1 script using the following command, this may take a few minutes:

   .\Cortex.Innovation.Install.WindowsFeatures.ps1
   

4. Check the output is as follows:

   Web-WebSockets is installed
   Web-Asp-Net45 is installed
   Web-Net-Ext45 is installed
   Web-ISAPI-Ext is installed
   Web-ISAPI-Filter is installed
   Net-Framework-45-Core is installed
   Net-Framework-45-ASPNET is installed
   Web-Default-Doc is installed
   Web-Dir-Browsing is installed
   Web-Http-Errors is installed
   Web-Static-Content is installed
   Web-Http-Logging is installed
   Web-Http-Redirect is installed
   Web-Request-Monitor is installed
   Web-Stat-Compression is installed
   Web-Dyn-Compression is installed
   Web-Filtering is installed
   Web-Windows-Auth is installed
   Web-Mgmt-Console is installed
   Web-Mgmt-Service is installed
   

Register and Allow .NET CLR v4.0.30319 with IIS

1. Open a Windows PowerShell (x64) window as administrator.

2. Run the following command:

   Dism /online /enable-feature /featurename:IIS-ASPNET45 /all
   

3. Once PowerShell confirms that it has finished installing .NET CLR v4.0.30319, close the PowerShell window.

Install URL Rewrite Module

The URL Rewrite IIS Manager module is required to enable web applications on your server to rewrite URLs. This is needed to allow HTTP URLs to redirect to the equivalent HTTPS ones.

To install the URL Rewrite module take the following steps:

1. In the left-hand pane of Internet Information Service (IIS) Manager, select the server node.
2. Ensure that there is an icon with the title URL Rewrite under the IIS feature section:

   

3. If there is an icon, URL Rewrite module is installed and no further steps are required.
4. If there is no icon, the module is not installed and the following steps must be taken:
   1. Download the URL Rewrite module installer.
   2. Double-click on the installer file to run it.
   3. Follow the wizard to complete the installation.
   4. After successfully installing, close and reopen IIS Manager. The URL Rewrite icon should now be visible.

Add HTTPS Firewall Rule

If any firewall is running on the server, it must be configured to allow communication inbound via TCP on the port configured for HTTPS (usually 443). See Configure Firewalls for information about adding rules to Windows Firewall.

Create Web Site

Gateway and Flow Debugger Service can either be installed to an existing web site or a newly created web site. If you are installing into an existing web site skip to Configure Web Site.

The steps to create a new web site are:

1. In Windows File Explorer, navigate to the default IIS folder (usually %SystemDrive%\inetpub\wwwroot, e.g. C:\inetpub\wwwroot).
2. Ensure there is a folder called Cortex; if not create it.
3. In the left-hand pane of Internet Information Service (IIS) Manager, expand the server node.
4. Right-click the Sites node under the server and select Add Website….
5. Set the Site name to Cortex.
6. Set the Physical path to the folder created above (e.g. C:\inetpub\wwwroot\Cortex), by clicking on the ellipses …, selecting the appropriate directory and clicking OK.
7. Click OK. If an existing site is already using the specified port, a warning will be displayed. Either click No and change the Port in the Add Website dialog, or click Yes and stop the other website.

Configure Web Site

The web site which the Gateway and Flow Debugger Service are installed under requires additional configuration.

Configure HTTPS

Both the Gateway and Flow Debugger Service should be configured to use HTTPS:

1. In the left-hand pane of Internet Information Service (IIS) Manager, expand the server node.
2. Expand the Sites node under the server.
3. Right-click the web site where Gateway will be installed and select Edit Bindings….
4. Click Add…
5. Set Type to https.
6. Set the appropriate Port number (typically 443). The Host name box can be left blank.

   Note

   Configuring your system to use a port other than the HTTPS default of 443 is not compatible with HTTP Strict Transport Security (HSTS). If your configuration requires HTTPS to run on a port other than 443, the HSTS configuration must be turned off. This can be achieved by configuring the Add Strict-Transport-Security when HTTPS rewrite rule’s enabled setting to false in web.config after installation.
7. Select the SSL certificate that was used when installing the Application Server. If self-signed certificates were used, this will have the subject CN=CortexServerCertificate.
8. Click OK. If an existing site is already using the specified SSL port, a warning will be displayed. Either click No and change the Port in the Add Site Binding dialog, or click Yes and stop the other website.
9. It is recommended to remove the http site binding.

Install Flow Debugger Service

Get Application Pool User

A domain user account is required for the Flow Debugger Service web application pool and must be created prior to performing the installation. In line with best practices, this account should not be used for any purposes other than those specified for the Flow Debugger Service. Alternatively, the NETWORK SERVICE user may also be used.

This user must currently have access to the default NuGet directory, in order to load block packages correctly. To add permissions for the user take the following steps:

1. Navigate to %SystemRoot%\System32\config\systemprofile\AppData\Roaming\ and create a new folder named NuGet if one does not exist.
2. Right-click on the NuGet folder and click Properties.
3. In the dialog, click the Security tab.
4. Click the Edit... button.
5. Click the Add... button.
6. Enter the username of the application pool user and click OK.
7. In the Permissions section at the bottom, check Full control
8. Click OK.

The user must be given Log on as a service and Log on as a batch job permissions. To do this take the following steps:

1. Navigate to Start -> Administrative Tools -> Local Security Policy.
2. In the Local Security Policy dialog, expand the Local Policies node then select User Rights Assignment.
3. Take the following steps for the Log on as a service and Log on as a batch job policies:
   1. In the right-hand panel, double-click on the policy.
   2. In the Properties dialog, click on the Add User or Group button.

      Note

      It is possible to use the Advanced… button to look up names rather than entering them manually. Various filters can be set to find the correct user or group more easily. Multiple users can be selected by holding down CTRL while clicking. OK adds the selected users or groups into the Enter the object names to select text box.
   3. Type the name of the application pool user account into the Enter the object names to select text box. Click the Check Names button to confirm that the user exists.
   4. Click OK on the Select Users dialog, and then confirm the user is correct by clicking OK on the Properties dialog.

Configure Installation Script

1. In the Cortex Innovation 2022.9 - Web App Server Install Scripts folder, locate the Cortex.Innovation.Install.FlowDebuggerService.ps1 script and open it with a text editor.

2. Choose the tab below that matches the configuration for this installation, then update the script to match, changing the parameters according to the details given below:

   • CA Certs
   • Self-Signed Certs

   
   .\Cortex.Install.FlowDebuggerService.ps1 `
       -FlowDebuggerServicePath "C:\Install\Cortex Innovation 2022.9 - Flow Debugger Service.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -FlowDebuggerBasicAuthUserName "BasicAuthUser" `
       -FlowDebuggerBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -Credential $AppPoolIdentity `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-flow-debugger-service-install-log.txt"
           

   
   .\Cortex.Install.FlowDebuggerService.ps1 `
       -FlowDebuggerServicePath "C:\Install\Cortex Innovation 2022.9 - Flow Debugger Service.zip" `
       -BlockPackagesPath "C:\Install\Cortex Innovation 2022.9 - Block Packages.zip" `
       -FlowDebuggerBasicAuthUserName "BasicAuthUser" `
       -FlowDebuggerBasicAuthPwd "ADA9883B11BD4CDC908B8131B57944A4" `
       -UseSelfSignedCertificates `
       -Credential $AppPoolIdentity `
       -AcceptEULA:$AcceptEula `
       *>&1 | Tee-Object -FilePath "cortex-flow-debugger-service-install-log.txt"
           

   Name	Description
   FlowDebuggerServicePath	Configure this value with the location of the Flow Debugger Service zip file on the server.
   BlockPackagesPath	Configure this value with the location of the Block Packages zip file on the server.
   FlowDebuggerBasicAuthUserName	Configure this value with the username that will be used for Basic Authentication when Gateway makes HTTPS requests to the Flow Debugger Service. For security reasons it is recommended that the default value BasicAuthUser should be changed. Currently only Basic Authentication using a single user is supported, OAuth2 will be supported in a future release. This value will be needed later, when installing Gateway.
   FlowDebuggerBasicAuthPwd	Configure this value with the password that will be used for Basic Authentication when Gateway makes HTTPS requests to the Flow Debugger Service. This password should be Cortex Encrypted. For security reasons it is recommended that the default value ADA9883B11BD4CDC908B8131B57944A4 should be changed. This value will be needed later, when installing Gateway.
   UseSelfSignedCertificates	Enables Flow Debugger Service to communicate with Gateway using generated Self-Signed Certificates rather than CA Certificates. Not recommended for production use.
   Credential	The credentials of the user that will be used to run the Debugger application pool in IIS. This does not need to be changed, a prompt will appear to enter this information when the script is run.
   AcceptEULA	This does not need to be changed, the EULA will be accepted at a later stage.
   FilePath	The filename that installation logs are written to. If this should be written to a different location than where the installation files are then a full path should be specified.

3. Save and close Cortex.Innovation.Install.FlowDebuggerService.ps1.

Run Installation Script

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - Web App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - Web App Server Install Scripts"
   

3. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.FlowDebuggerService.ps1
   

4. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -AcceptEULA
   

5. Run the PowerShell command to install the Flow Debugger Service.

6. A credentials prompt will appear. Enter the credentials of the user that should run the Debugger application pool in IIS. If using the NETWORK SERVICE user, enter any user as the username and leave the password blank; the NETWORK SERVICE user will need to be selected in the final step.

7. Wait for the script to finish running. This should take approximately 2 minutes.

8. An error may have appeared saying:

   The Windows Process Activation Service service is not started.
   

   This can be ignored.

9. Check that there have been no other errors in the script; these would appear in red in the console.

   If there are any errors, then please follow any instructions given within them to rectify the situation, and retry the installation.

   If the errors do not give any instructions on how to rectify, please contact Cortex Service Portal for further assistance.

10. If using NETWORK SERVICE for the application pool user:

    1. Open Internet Information Services (IIS) Manager.
    2. On the left, expand the server node.
    3. Click Application Pools.
    4. Right-click on the Debugger application pool and select Advanced Settings....
    5. In the Advanced Settings dialog, click on Identity and then click the ellipses (...).
    6. In the Application Pool Identity dialog, select Built-in account, then select NetworkService from the drop-down, then click OK.
    7. Right-click on the Debugger application pool and click Recycle....

Install Gateway

Get Application Pool User

A domain user account is required for the Gateway web application pool and must be created prior to performing the installation below.

This user account is required to enable Gateway to access the Cortex database, with the following roles:

• dbcreator
• public

To add roles to database users take the following steps:

1. Open SQL Server Management Studio on the server and log in.

2. Expand the server node, then Security then Logins.

3. If the user that will run the Gateway application pool is not in the list of logins, take the following steps, otherwise skip to step 4:

   1. Right-click the Logins node and click New Login....
   2. Enter the application pool user in the Login name box.
   3. On the left pane, click Server Roles.
   4. Check public and dbcreator
   5. Click OK.

4. If the user that will run the Gateway application pool is in the list of logins, take the following steps:

   1. Right-click on the application pool user.
   2. Click Properties.
   3. On the left pane, click Server Roles.
   4. Check public and dbcreator.
   5. Click OK.

In line with best practices, this account should not be given administrator rights, nor should it be used for any purposes other than those specified for Gateway.

The user must be given Log on as a service and Log on as a batch job permissions. To do this take the following steps:

1. Navigate to Start -> Administrative Tools -> Local Security Policy.
2. In the Local Security Policy dialog, expand the Local Policies node then select User Rights Assignment.
3. Take the following steps for the Log on as a service and Log on as a batch job policies:
   1. In the right-hand panel, double-click on the policy.
   2. In the Properties dialog, click on the Add User or Group button.

      Note

      It is possible to use the Advanced… button to look up names rather than entering them manually. Various filters can be set to find the correct user or group more easily. Multiple users can be selected by holding down CTRL while clicking. OK adds the selected users or groups into the Enter the object names to select text box.
   3. Type the name of the application pool user account into the Enter the object names to select text box. Click the Check Names button to confirm that the user exists.
   4. Click OK on the Select Users dialog, and then confirm the user is correct by clicking OK on the Properties dialog.

Create Gateway Application Pool

1. Open Internet Information Services (IIS) Manager.
2. Select and right-click the Application Pools node under the server and select Add Application Pool…
3. Set Name to Cortex Gateway.
4. Ensure that the .NET CLR version is set to .NET CLR Version v4.0.30319 (This may be configured by default).
5. Ensure that the Managed pipeline mode is set to Integrated (This may be configured by default).
6. Click OK
7. Right click on the created application pool and select Advanced Settings…
8. Click the ... next to Identity (under Process Model) to open a dialog, then select Custom Account and Set....
9. Enter the username and password for the user identified in Get Application Pool User.
10. Click OK to close the Set Credentials dialog.
11. Click OK to close the Application Pool Identity dialog.
12. Click OK to close the Advanced Settings dialog.

Create New Web Application

1. In the left-hand pane of Internet Information Service (IIS) Manager, expand the server node.
2. Right-click on the site the application should be installed under and select Add Application…
3. Set the Alias to gateway. This must be lowercase.
4. Click Select… and from the Application pool dropdown select the Cortex Gateway application pool and click OK.
5. Set the Physical path to C:\inetpub\wwwroot\Cortex\Gateway by clicking on the ellipses … and selecting the appropriate directory. Create the C:\inetpub\wwwroot\Cortex\Gateway directory if it does not already exist.
6. Click OK.

Configure IIS Site Redirect to the Specified Web Application (Optional)

If the site hosting the Gateway web application is a newly created Cortex site or an existing site that doesn’t have its own content, it is recommended to redirect the site URL to the gateway web application URL, e.g. https://FullyQualifiedDomainName to https://FullyQualifiedDomainName/gateway.

1. Open Internet Information Services (IIS) Manager.
2. Select the site hosting the gateway web application and from IIS settings double-click the HTTP Redirect icon.
3. Click the check box Redirect requests to this destination.
4. Enter https://FullyQualifiedDomainName/gateway, replacing FullyQualifiedDomainName with the FQDN of the server.
5. In the Redirect Behaviour section, click Only redirect requests to content in this directory (not subdirectories).
6. In Actions click the Apply button.

Configure Installation Script

1. In the Cortex Innovation 2022.9 - Web App Server Install Scripts folder, locate the Cortex.Innovation.Install.Gateway.ps1 script and open it with a text editor.

2. Configure the script according to the details given below:

   .\Cortex.Install.Gateway.ps1 `
   -GatewayPackagePath "C:\Install\Cortex Innovation 2022.9 - Gateway.zip" `
   -GatewayApplicationIISPath "Cortex\gateway" `
   -ModelDBContextConnectionString "Data Source=localhost;Initial Catalog=CortexWeb;Integrated Security=True;MultipleActiveResultSets=True" `
   -AuthContextConnectionString "Data Source=localhost;Initial Catalog=CortexWeb.Auth;Integrated Security=True;MultipleActiveResultSets=True" `
   -SignalRContextConnectionString "Data Source=localhost;Initial Catalog=CortexWeb.SignalR;Integrated Security=True;MultipleActiveResultSets=True" `
   -FeatureFlags "InnovationId" `
   -ServiceFabricApiGatewayEndpoint "https://server.domain.com:8722/" `
   -ServiceFabricUsingSelfSignedCertificates $false `
   -ServiceFabricApiGatewayBasicAuthUsername "BasicAuthUser" `
   -ServiceFabricApiGatewayBasicAuthPassword "ADA9883B11BD4CDC908B8131B57944A4" `
   -DotNetFlowDebuggerEndpoint "https://server.domain.com/debugger/api/" `
   -DotNetFlowDebuggerBasicAuthUsername "BasicAuthUser" `
   -DotNetFlowDebuggerBasicAuthPassword "ADA9883B11BD4CDC908B8131B57944A4" `
   -DotNetFlowDebuggerUsingSelfSignedCertificates $false `
   -Test:$Test `
   -AcceptEULA:$AcceptEula `
   *>&1 | Tee-Object -FilePath "cortex-gateway-install-log.txt"
   

   Name	Description
   GatewayPackagePath	Configure this value with the location of the Cortex Innovation 2022.9 - Gateway.zip file on the installation server.
   GatewayApplicationIISPath	Change to the correct Site Name/Application if either was modified from the defaults (Cortex/gateway) when creating the website or application.
   ModelDBContextConnectionString	If SQL Server was installed as the default instance, change the Data Sourcein the connection string to localhost. If SQL Server was installed as a named instance, change it to .\{instanceName} replacing {instanceName} with the name of the instance. This will set the ModelDBContextConnectionString value in the Gateway web.config.
   AuthContextConnectionString	If SQL Server was installed as the default instance, change the Data Sourcein the connection string to localhost. If SQL Server was installed as a named instance, change it to .\{instanceName} replacing {instanceName} with the name of the instance. This will set the AuthContextConnectionString value in the Gateway web.config.
   SignalRContextConnectionString	If SQL Server was installed as the default instance, change the Data Sourcein the connection string to localhost. If SQL Server was installed as a named instance, change it to .\{instanceName} replacing {instanceName} with the name of the instance. This will set the SignalRContextConnectionString value in the Gateway web.config.
   FeatureFlags	Replace InnovationId with the Cortex Innovation feature identifier, which should have been provided by Cortex when fulfilling the Licensing Requirements, if it wasn’t it should be requested using Cortex Service Portal. This will set the FeatureFlags value in the Gateway web.config.
   ServiceFabricApiGatewayEndpoint	Replace server.domain.com with the fully qualified domain name of the server. The port should be specified as 8722 and there must be a trailing slash, e.g. https://server.domain.com:8722/. This will set the ServiceFabricApiGatewayEndpoint value in the Gateway web.config.
   ServiceFabricUsingSelfSignedCertificates	Configure the value as $false if you used valid CA certificates when installing the Application Server, $true if you used self-signed certificates. This will set the ServiceFabricUsingSelfSignedCertificates value in the Gateway web.config.
   ServiceFabricApiGatewayBasicAuthUsername	This must be changed if you used a non-default ApiGatewayBasicAuthUserName when installing the Application Server; if so, this value must be configured to the one used. This will set the ServiceFabricApiGatewayBasicAuthUsername value in the Gateway web.config.
   ServiceFabricApiGatewayBasicAuthPassword	This must be changed if you used a non-default ApiGatewayBasicAuthPassword when installing the Application Server; if so, this value must be configured to the one used. It can be Cortex Encrypted. This will set the ServiceFabricApiGatewayBasicAuthPassword value in the Gateway web.config.
   DotNetFlowDebuggerEndpoint	Replace server.domain.com with the fully qualified domain name of the Web Application Server. This will set the DotNetFlowDebuggerEndpoint value in the Gateway web.config.
   DotNetFlowDebuggerBasicAuthUsername	This must be changed if you used a non-default FlowDebuggerBasicAuthUserName when installing the Flow Debugger Service; if so, this value must be configured to the one used. This will set the DotNetFlowDebuggerBasicAuthUsername value in the Gateway web.config.
   DotNetFlowDebuggerBasicAuthPassword	This must be changed if you used a non-default FlowDebuggerBasicAuthPassword when installing the Flow Debugger Service; if so, this value must be configured to the one used. It can be Cortex Encrypted. This will set the DotNetFlowDebuggerBasicAuthPassword value in the Gateway web.config.
   DotNetFlowDebuggerUsingSelfSignedCertificates	Configure the value as $false if you are using valid CA certificates to secure the site containing Gateway and Flow Debugger Service, $true if using self-signed certificates. This will set the DotNetFlowDebuggerUsingSelfSignedCertificates value in the Gateway web.config.
   Test	This does not need to be changed, it will be set at a later stage.
   AcceptEULA	This does not need to be changed, the EULA will be accepted at a later stage.
   FilePath	The filename that installation logs are written to. If this should be written to a different location than where the installation files are then a full path should be specified.

3. Save and close Cortex.Innovation.Install.Gateway.ps1.

Test Installation Script

1. Open a Windows PowerShell (x64) window as administrator.

2. Navigate PowerShell to inside the Cortex Innovation 2022.9 - Web App Server Install Scripts folder using the following command, modifying the path as necessary:

   cd "C:\Install\Cortex Innovation 2022.9 - Web App Server Install Scripts"
   

3. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.Gateway.ps1 -Test
   

4. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -Test -AcceptEULA
   

5. Run the PowerShell command to test the configuration. In the event of any errors, there will be an error message displayed at the end of the output with a line confirming the Error Count.

Run Installation Script

1. Ensure the Gateway application pool is stopped:

   1. Open Internet Information Service (IIS) Manager.
   2. In the left pane, expand the server node.
   3. Click Application Pools to display a list of the Application Pools.
   4. Right-click the Cortex Gateway application pool and select Stop.

   Note

   Failure to stop the application pool will result in a permissions error when installing Gateway.

2. Type the following command into PowerShell:

   .\Cortex.Innovation.Install.Gateway.ps1
   

3. Please read the End User Licence Agreement which can be found here. Once you agree to the terms, add the flag -AcceptEULA to the command entered above, e.g:

   .\<CortexInnovationInstallScriptName>.ps1 -AcceptEULA
   

4. Run the PowerShell command to install Gateway. In the event of any errors, there will be an error message displayed at the end of the output with a line confirming the Error Count.

5. Ensure that the user identified in Get Application Pool User has Full control access to the Gateway folder created in Create New Web Application:

   1. Navigate to C:\inetpub\wwwroot\Cortex\.
   2. Right-click the Gateway folder and click Properties.
   3. In the Gateway Properties dialog, click the Security tab.
   4. Click the user identified in Get Application Pool User within the Group or user names section.
   5. In the Permissions section, ensure the user has Full control checked. If not:
      1. Click the Edit... button.
      2. Select the user identified in Get Application Pool User within the Group or user names section.
      3. In the Permissions section, check Full control.
      4. Click OK, then wait for Windows Security to update the security information to the folder.
      5. Click OK.

6. Start the Gateway application pool:

   1. Open Internet Information Service (IIS) Manager.
   2. In the left pane, expand the server node.
   3. Click Application Pools to display a list of the Application Pools.
   4. Right-click the Cortex Gateway application pool and select Start.

7. Once the application pool has been started, the site will be available on <protocol>://<host>:<port>/<webapplicationname>, e.g. https://localhost/gateway.

   Note

   If the application pool does not stay started, ensure that the user it runs as has Log on as a service and Log on as a batch job permissions or belongs to a group that has those permissions.

Preserve installation files

Ensure that the installation files are backed up or kept on the server, especially the scripts and config files that have been modified. This will make it easier to perform further actions in future, such as troubleshooting, certificate rollover, uninstallation, reinstallation and updates.

Next Steps?

1. Setup Gateway

3.1.1.2.5 - Setup Gateway

Setup Gateway

This guide describes how to setup Gateway. Please ensure that Install Web Application Server has been completed before taking these steps.

Gateway Initial Setup

Log on to Gateway and run through the setup wizard:

1. Open a supported web browser and navigate to <protocol>://<host>:<port>/<webapplicationname>, e.g. https://localhost/gateway.

   If an error message is displayed in the browser, wait a few minutes and refresh the page as it is possible that the website was still starting.

2. Log on using the default credentials that Gateway deploys with:

   Username: administrator

   Password: Adm1n1strat0r

3. On a newly installed system, you will be presented with a Setup Wizard at this point, which will guide you through some basic configuration steps:

   • Account Details
   • LDAP Connection
   • LDAP Authorisation

4. Follow the steps in the setup wizard to configure the relevant areas:

   Account Details

   1. Click Next Step:

      

   2. Enter an email address for the Administrator and click Next Step:

      

   3. Change the Administrator password to a unique, secret password and click Next Step:

      

   LDAP Connection

   1. Enter the details of your Active Directory server and provide a Username and Password for a user with read access to it:

      A connection to an Active Directory server must be established in order to assign authorisation rights to users.

      1. In the Server field, enter the Hostname, FQDN or IP Address of the Active Directory server that Gateway should use to authenticate and authorise users.
      2. In the Port field, enter the port number of the Active Directory server. The well-known port for LDAP traffic is 389; if SSL encryption is used, the well-known port is 636.
      3. If an SSL connection is to be used, tick the box Use SSL.
      4. In the Username field, enter a valid username of a user that has read permissions for the Active Directory server.
      5. In the Password field, enter the password of the user entered in the previous step.
      6. To reduce the scope of any Active Directory searches, add one or more base DNs (Distinguished Names). For each base DN click Add and enter the full LDAP path e.g CN=group, OU=organisational unit, DC=domain, DC=com. These will be used as the roots of any Active Directory searches performed. For more information about distinguished names see https://msdn.microsoft.com/en-us/library/aa366101(v=vs.85).aspx.

   2. Click Test Connection to validate the connection and the user credentials entered and click Next Step.

   

   LDAP Authorisation

   1. If the authorisation grid fails to load first time round, click Retry.

   2. Assign access permissions to Active Directory groups:

      To allow users to access the various roles within Gateway, it is first necessary to assign them the appropriate access rights. Gateway currently supports four roles, but only two are relevant for Cortex Innovation:

      • Admin
      • Studio

      To give a user access to a role, set access for a group or Organisational Unit (OU) that the user is a member of:

      1. Expand the groups or OUs, or search for the group or OU, to be assigned one or more roles.
      2. Check the relevant roles for each group. Checking a parent group will cascade the setting to all child groups.

      

   3. Click Complete Setup to commit the changes.

   4. To test the permissions, log out as Administrator and then log in as a user with Studio permissions.

Configure the Gateway Databases to use Transparent Data Encryption

Once Gateway has been configured, if you wish to encrypt the databases using Transparent Data Encryption for improved security, this should now be performed by following the steps in Configuring TDE.

Next Steps?

1. Try it out

3.1.1.2.6 - Try it out

Try it out

This guide describes how to try out a new Innovation installation to make sure it is working. Please ensure that Setup Gateway has been completed before taking these steps.

Test Debugging Flows

Test the platform by creating a new flow and executing it using the following steps:

1. Click on the Flows charm, then the + button and click Group to open a dialog.
2. Enter a name for the group, configure the Permission Groups and click OK to create the group.
3. Click on the group to open it (refresh the page if it does not appear).
4. Inside the group, click the + button again and click on Flow to open a dialog. If the menu item is not present, it means that the FeatureFlags in the CortexGateway.SetParameters.xml file was not set properly when installing Gateway. See Troubleshooting for more information.
5. Enter a name for the flow, configure the Permission Groups and click OK to create the flow.
6. The flow should be displayed with a start flow block and end flow block. A list of block palettes should be displayed down the left hand side:

   

   If the blocks in the flow do not display or the palettes are not visible, see Troubleshooting for more information.
7. Add a Set Variable block and connect it between the start and end blocks.
8. Click the Set Variable block to open the Property Editor.
9. Set the Value property to the expression DateTimeOffset.Now.
10. Type Result into the Variable property and click Create Result.
11. In the Variable Editor, set Is Output Variable? to true for the new Result variable.
12. Set a breakpoint on the end block and start the flow. An execution token should appear, the Result variable should show the current time. If the token does not appear, try refreshing the page.
13. Continue or stop the execution.
14. Commit the flow.

Test Publishing Production Flows

1. Log in to Gateway with a user that has the Admin role.
2. Click on the Settings charm, then Packages.
3. Click Add Package Definition. Enter a package name and select the new flow to add to the package. Click Save to save the new package.
4. Click Publish. A success message should appear. If it doesn’t it means that either one or more of the parameters prefixed with Service Fabric in the CortexGateway.SetParameters.xml file was not set properly when installing Gateway, or the Application Services aren’t healthy. See Troubleshooting for more information.

Test Executing Production Flows

1. Open an HTTP client, such as Postman. Make a request with the following format:

   Property	Value
   Action	POST
   URL	https://{FQDN of server}:8722/api/default/default/flows/{Flow Name}/executions?packageName={Package Name} e.g. https://server.domain.com:8722/api/default/default/flows/NewFlow/executions?packageName=NewPackage
   Content Type	application/json
   Body	{}
   Authentication	Basic
   Username	The value used for ApiGatewayBasicAuthUserName when installing Application Services
   Password	The value used for ApiGatewayBasicAuthPwd when installing Application Services (Unencrypted)

   Note

   If you used self-signed certificates when installing the server you will need to disable SSL certificate validation in your HTTP client.

2. The request should return a JSON object with the output variables of the flow e.g. { "Output": "2022-03-09T07:35:16+0000" }.

3. Cortex Innovation has now been verified and is ready to use.

3.1.1.3 - Advanced Setup

3.1.1.3.1 - Advanced Application Server and Load Balancer Configuration Changes

Advanced Application Server and Load Balancer Configuration Changes

Advanced configuration (such as port changes) can be undertaken by taking the following steps before running the PowerShell script. Some values will be modified by the script and they will take precedence, but those parameters can be removed from the script and this file used entirely if required.

Multiple Server With HA

1. In the Cortex Innovation 2022.9 - Installation Scripts folder, locate the file Cortex.Innovation.Install.Config.json and open it with a text editor.

2. Change the configuration file according to your cluster, referring to the following example and details:

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85

   { "customers": [ { "name": "Customer1", "isPrimary": true, "rules": { "clientConnectionEndpointPort": "8001", "clusterConnectionEndpointPort": "8002", "leaseDriverEndpointPort": "8003", "serviceConnectionEndpointPort": "8004", "httpGatewayEndpointPort": "9080", "reverseProxyEndpointPort": "9081", "applicationPorts": "10010-10500", "ephemeralPorts": "10501-20000" }, "loadBalancer": { "installDirectory": "%ProgramData%\\loadbalancer", "iPAddress": "192.168.20.178", "loadBalancerSnmpPort": "162", "snmpReceiverServicePort": "10001", "loadBalancerTlsPort": "443", "apiGatewayServicePort": "8722", "adminCertificate": "loadBalancerCertificate" }, "servers": [ { "serverName": "app-server1", "iPAddress": "192.168.1.1" }, { "serverName": "app-server2", "iPAddress": "192.168.1.2" }, { "serverName": "app-server3", "iPAddress": "192.168.1.3" } ] } ], "servers": { "app-server1": { "faultDomain": "fd:/fd1", "serverCertificate": "serverCert" }, "app-server2": { "faultDomain": "fd:/fd2", "serverCertificate": "serverCert" }, "app-server3": { "faultDomain": "fd:/fd3", "serverCertificate": "serverCert" } }, "rules": { "windowsSmbRemoteRegistry": [ "135", "137", "138", "139", "445" ], "rabbitMqAmqpPorts": [ "5671" ], "rabbitMqEpmdPort": "4369", "rabbitMqErlangDistributionClientPorts": "35672-35682", "rabbitMqErlangDistributionServerPort": "25672", "rabbitMqManagementApiPort": "15671" }, "serverCertificates": { "serverCert": { "pfxCertificatePath": "C:\\Certificates\\wildCardCert.pfx", "pfxCertificatePassword": "pfxPassword", "pemRootCertificatePath": "" } }, "adminCertificates": { "loadBalancerCert": { "pfxCertificatePath": "C:\\Certificates\\lbCert.pfx", "pfxCertificatePassword": "pfxPassword", "pemRootCertificatePath": "" } } }

   Line	Description
   4	A name identifying the platform being installed. This should have no spaces or symbols. It will be appended to the node names that are displayed in the Service Fabric management tool.
   16-24	If the bundled load balancer is not being used, delete these lines
   17	A local empty or non-existent directory on the load balancer server that the load balancer can be installed in. The directory path will be created if it does not exist. The installation user must have permissions to create and write to directories here. Ensure that all backslashes are escaped with another backslash. Environment variables may be used.
   18	The IPv4 address of the server that the load balancer should run on.
   21	The port that the HTTPS load balancer server should run on. This port should not be in use by anything else.
   22	The port that the API Gateway Service is running on the Application Servers. This should be 8722.
   23	The name of a certificate entry in the adminCertificates section. If this line is removed, an auto-generated self-signed certificate will be used.
   27, 31, 35	The short computer names of the Application Servers. These must not contain the domain. The installation will be run on the first of these nodes.
   28, 32, 36	The respective IPv4 addresses of the Application Servers.
   42, 46, 50	These keys should be changed to the computer names of the Application Servers to match those on lines 26, 30 and 24
   44, 48, 52	The name of a certificate entry in the serverCertificates section. This should be the same for all Application Servers. If these lines are removed, an auto-generated self-signed certificate will be used. Self-signed certificates are not recommended for production systems.
   73-75	Skip configuring these lines if self-signed certificates are being used.
   80-82	Skip configuring these lines if self-signed certificates are being used or if the bundled load balancer is not being used.
   74	This is the local path of a .PFX certificate file on the first Application Server, containing a full chain certificate with private key. Ensure that all backslashes are escaped with another backslash. Environment variables cannot be used.
   75	The password used to secure the .PFX file.
   76	This only needs to be used if the installation has failed due to a missing root certificate. See Troubleshooting Root Certificate Error for information.
   81	This is the local path of a .PFX certificate file on the first Application Server, containing a full chain certificate with private key. Ensure that all backslashes are escaped with another backslash. Environment variables cannot be used.
   82	The password used to secure the .PFX file.
   83	This only needs to be used if the installation has failed due to a missing root certificate. See Troubleshooting Root Certificate Error for information.

3. Save and close the config file.

Single Server Without HA

1. In the Cortex Innovation 2022.9 - Installation Scripts folder, locate the file Cortex.Innovation.Install.Config.json and open it with a text editor.

2. Change the configuration file according to your cluster, referring to the following example and details:

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53

   { "customers": [ { "name": "Customer1", "isPrimary": true, "rules": { "clientConnectionEndpointPort": "8001", "clusterConnectionEndpointPort": "8002", "leaseDriverEndpointPort": "8003", "serviceConnectionEndpointPort": "8004", "httpGatewayEndpointPort": "9080", "reverseProxyEndpointPort": "9081", "applicationPorts": "10010-10500", "ephemeralPorts": "10501-20000" }, "servers": [ { "serverName": "app-server1", "iPAddress": "192.168.1.1" } ] } ], "servers": { "app-server1": { "faultDomain": "fd:/fd1", "serverCertificate": "serverCert" } }, "rules": { "windowsSmbRemoteRegistry": [ "135", "137", "138", "139", "445" ], "rabbitMqAmqpPorts": [ "5671" ], "rabbitMqEpmdPort": "4369", "rabbitMqErlangDistributionClientPorts": "35672-35682", "rabbitMqErlangDistributionServerPort": "25672", "rabbitMqManagementApiPort": "15671" }, "serverCertificates": { "serverCert": { "pfxCertificatePath": "C:\\Certificates\\wildCardCert.pfx", "pfxCertificatePassword": "pfxPassword", "pemRootCertificatePath": "" } } }

   Line	Description
   4	A name identifying the platform being installed. This should have no spaces or symbols. It will be appended to the node names that are displayed in the Service Fabric management tool.
   18	The short computer names of the node. This must not contain the domain. The installation will be run on the this node.
   19	The IPv4 address of the node.
   25	This key should be changed to the computer names of the node to match that on line 18
   27	The name of a certificate entry in the serverCertificates section. If this line is removed, an auto-generated self-signed certificate will be used. Self-signed certificates are not recommended for production systems.
   48-50	Skip configuring these lines if self-signed certificates are being used.
   48	This is the local path of a .PFX certificate file on the server, containing a full chain certificate with private key. Ensure that all backslashes are escaped with another backslash. Environment variables cannot be used.
   49	The password used to secure the .PFX file.
   50	This only needs to be used if the installation has failed due to a missing root certificate. See Troubleshooting Root Certificate Error for information.

3. Save and close the config file.